CVEs-PoC/2006/CVE-2006-1546.md

CVE-2006-1546

Description

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

POC

Reference

No PoCs from references.

Github

• https://github.com/sam8k/Dynamic-and-Static-Analysis-of-SOUPs
• https://github.com/vikasvns2000/StrutsExample