File tree Expand file tree Collapse file tree 2 files changed +7
-7
lines changed
documentation/modules/exploit/windows/http Expand file tree Collapse file tree 2 files changed +7
-7
lines changed Original file line number Diff line number Diff line change 11## Vulnerable Application
22
3- The Sitecore Experience Platform (XP) is flagship CMS product.
3+ The Sitecore Experience Platform (XP) is a flagship CMS product.
44Provides comprehensive digital marketing tools, view of customer data and many other features.
5- Sitecore deploys multiple default service accounts when installing, among them ServicesAPI.
6- The versions from 10 to 10.4 have hardcoded password for this account - the password is letter b (CVE-2025 -34509).
7- This account is used to gain access and exploit additional vulnerability - path traversal in zip extraction (CVE-2025 -34510).
8- This module exploits both vulnerabilities to gain remote code execution by uploading malicious ASPX into root directory of webserver.
5+ Sitecore deploys multiple default service accounts when installing, among them is an account called ServicesAPI.
6+ The versions from 10 to 10.4 have a hardcoded password for this account - the password is the letter b (CVE-2025 -34509).
7+ This account is used to gain access and exploit an additional vulnerability - a path traversal in zip extraction (CVE-2025 -34510).
8+ This module exploits both vulnerabilities to gain remote code execution by uploading malicious ASPX into the root directory of the webserver.
99
1010### Installation
1111
Original file line number Diff line number Diff line change 11## Vulnerable Application
22
3- The Sitecore Experience Platform (XP) is flagship CMS product.
3+ The Sitecore Experience Platform (XP) is a flagship CMS product.
44Provides comprehensive digital marketing tools, view of customer data and many other features.
55A user can install multiple extensions to Sitecore XP - among them is Sitecore PowerShell Extension (SPA).
66It is obligatory requirement for popular SXA add-on.
7- The SPA is vulnerable to unrestricted file upload up to version 7.0.
7+ The SPA is vulnerable to an unrestricted file upload up to version 7.0.
88An attacker can upload malicious ASPX file and gain remote code execution.
99
1010
You can’t perform that action at this time.
0 commit comments