Description
Eramba是英国Eramba公司的一款开源的企业级IT治理应用程序。该程序具有IT安全、合规性审计分析等功能。 Eramba 3.19.1版本存在代码注入漏洞，该漏洞源于Eramba Web 应用程序允许经过身份验证的用户的代码执行，攻击者利用该漏洞可以修改 URL 中的参数path，在应用程序运行的用户帐户上下文中执行命令。
Eramba download-test-pdf 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://cn-sec.com/archives/1961543.html
https://www.rapid7.com/db/modules/exploit/linux/http/eramba_rce/
https://vulners.com/packetstorm/PACKETSTORM:173888
https://www.fortiguard.com/encyclopedia/ips/57603
https://nvd.nist.gov/vuln/detail/CVE-2023-36255
https://trovent.io/security-advisory-2303-01/
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eramba_rce.rb
https://sploitus.com/exploit?id=PACKETSTORM:190048
https://www.redteam.wang/static/downloads/2023hvvday%20POC%E9%9B%86%E5%90%88.pdf
https://attackerkb.com/contributors/msutovsky-r7