{"id":22799826,"url":"https://github.com/chocapikk/cve-2023-51467","last_synced_at":"2025-07-29T17:14:26.813Z","repository":{"id":214643316,"uuid":"737019244","full_name":"Chocapikk/CVE-2023-51467","owner":"Chocapikk","description":"Apache OfBiz Auth Bypass Scanner for CVE-2023-51467","archived":false,"fork":false,"pushed_at":"2023-12-31T01:23:55.000Z","size":9,"stargazers_count":11,"open_issues_count":2,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-20T17:17:12.378Z","etag":null,"topics":["apache-ofbiz","auth-bypass","bugbounty","cve-2023-51467","cybersecurity","ethical-hacking","exploit","infosec","open-source-security","patch-management","penetration-testing","security-automation","security-tools","vulnerability-detection","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"https://threatprotect.qualys.com/2023/12/27/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-51467/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Chocapikk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-29T15:01:46.000Z","updated_at":"2025-01-27T23:57:23.000Z","dependencies_parsed_at":"2023-12-29T16:24:54.180Z","dependency_job_id":"94836f3c-4c3d-42a9-b343-281ea96cc729","html_url":"https://github.com/Chocapikk/CVE-2023-51467","commit_stats":null,"previous_names":["chocapikk/cve-2023-51467"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Chocapikk/CVE-2023-51467","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-51467","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-51467/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-51467/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-51467/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Chocapikk","download_url":"https://codeload.github.com/Chocapikk/CVE-2023-51467/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chocapikk%2FCVE-2023-51467/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267723704,"owners_count":24134193,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-29T02:00:12.549Z","response_time":2574,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apache-ofbiz","auth-bypass","bugbounty","cve-2023-51467","cybersecurity","ethical-hacking","exploit","infosec","open-source-security","patch-management","penetration-testing","security-automation","security-tools","vulnerability-detection","vulnerability-scanner"],"created_at":"2024-12-12T07:10:05.007Z","updated_at":"2025-07-29T17:14:26.762Z","avatar_url":"https://github.com/Chocapikk.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2023-51467 Scanner 🕵️‍♂️\n\n## Description 📜\n\nCVE-2023-51467 Scanner is a Python-based command-line tool 🛠️ that scans URLs for a specific vulnerability in the Apache OfBiz ERP system. This zero-day security flaw, tracked as CVE-2023-51467, allows attackers to bypass authentication protections due to an incomplete patch for the critical vulnerability CVE-2023-49070.\n\n## Vulnerability Details 🔐\n\nThe CVE-2023-51467 vulnerability resides in the login functionality of Apache OfBiz versions prior to 18.12.10. It can be exploited by sending an HTTP request with empty or invalid USERNAME and PASSWORD parameters, which results in an authentication success message, allowing unauthorized access to internal resources.\n\n## Installation 💻\n\nTo use the CVE-2023-51467 Scanner, you need Python 3.x.\n\nYou can install the required packages using `pip` 📦:\n\n```shell\npip install -r requirements.txt \n```\n\n## Usage 🚀\n\nTo scan a single URL 🎯:\n\n```shell\npython exploit.py -u http://example.com\n```\n\nTo scan a list of URLs from a file 📊:\n\n```shell\npython exploit.py -f urls.txt -o output.txt -t 50\n```\n\n## Options ⚙️\n\n- `-u`, `--url`: Single URL to send the GET request to 🌐.\n- `-f`, `--file`: File containing a list of base URLs to scan 📄.\n- `-o`, `--output`: File to write vulnerable systems to (default is `output.txt`) 📝.\n- `-t`, `--threads`: Number of concurrent threads to use (default is 10) 🧵.\n\n## Disclaimer ⚠️\n\nThis tool is intended for security research and should not be used for illegal activities. The authors of this tool cannot be held responsible for any misuse or damage from its use.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2023-51467","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchocapikk%2Fcve-2023-51467","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchocapikk%2Fcve-2023-51467/lists"}