logo

Database

Server side template injection In pyload-ng

Description

Code Injection in pyload-ng Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2023-02972. NVD-2023-02973. OSV-2023-02974. GCVE-2023-0297

References

1. https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d2. https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e653. http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html4. http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html5. https://vulncheck.com/cve/CVE-2023-02976. https://www.exploit-db.com/exploits/515327. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0297.yaml8. https://github.com/bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad9. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pyload_js2py_exec.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.