diff --git a/2023/CVE-2023-33145/README.MD b/2023/CVE-2023-33145/README.MD index d24a103..7d3fe88 100644 --- a/2023/CVE-2023-33145/README.MD +++ b/2023/CVE-2023-33145/README.MD @@ -3,3 +3,37 @@ ## [Vendor](https://www.microsoft.com/en-us/edge?form=MY01BV&exp=e414) ![](https://github.com/nu11secur1ty/Windows11Exploits/blob/main/2023/CVE-2023-33145/docs/Screenshot%202023-07-06%20123726.png) + +## Description: +The type of information that could be disclosed if an attacker successfully exploited this vulnerability is data inside the targeted website like IDs, tokens, nonces, cookies, IP, User-Agent, and other sensitive information. +The user would have to click on a specially crafted URL to be compromised by the attacker. +In this example, the attacker use STRIDE Threat Modeling to spoof the victim to click on his website and done. +This will be hard to detect. + +## Conclusion: +Please be careful, for suspicious sites or be careful who sending you an link to open! + +## Staus: HIGH Vulnerability + +[+]Exploit: + +- Exploit Server: + +```js +## This is a Get request from the server when the victims click! And it is enough to understand this vulnerability! =) + + + +## WARNING: The PoCsess.php will be not uploaded for security reasons! +## BR nu11secur1ty + +``` + +## Reproduce: +[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33146) + +## Proof and Exploit +[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33145-microsoft-edge.html) + +## Time spend: +01:30:00