.. / CVE-2022-28117

• SSRF
• Nuclei
• Web

Exploit for Navigate CMS 2.9.4 - Server-Side Request Forgery (CVE-2022-28117)

Description:

Navigate CMS 2.9.4 is susceptible to server-side request forgery via feed_parser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data modification, and/or unauthorized operation execution.

Nuclei Template

View the template here CVE-2022-28117.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-28117.yaml

References: