> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2024-11680 PoC Exploit in ProjectSend r1605 and Older Versions
- URL: https://darkwebinformer.com/cve-2024-11680-poc-exploit-in-projectsend-r1605-and-older-versions/
- Published: 2024-12-12T16:12:24.000Z
- Updated: 2025-09-04T22:25:01.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities, Tools

---

GitHub: <https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit>

---

# CVE-2024-11680 PoC Exploit

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#cve-2024-11680-poc-exploit)

This repository contains a Proof of Concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and older versions. The exploit targets a Cross-Site Request Forgery (CSRF) flaw in combination with Privilege Misconfiguration issues.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/12/5389221.png)

---

## Features

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#features)

- Exploits CSRF to modify the application title. This is the vulnerability confirmation.
- Enables insecure options (client registration, auto-approval, and file uploads).
- Registers a new user to demonstrate privilege misconfiguration issues.
- Automatically restores the original application title after testing.

---

## Usage

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#usage)

### Prerequisites

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#prerequisites)

1. A valid target running r1605 or earlier of **ProjectSend**.
2. curl: This script uses curl to send HTTP requests. You can check if curl is installed by running:

`bash command -v curl`

If it's not installed, you can install it using your package manager. For example, on Ubuntu:

`sudo apt-get install curl`

### Running the Exploit

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#running-the-exploit)

1. Clone this repository or download the script.
2. Run the exploit using the following syntax: `./exploit -u TARGET_URL`
3. Check the output for the generated username and password for the registered user.

---

## Disclaimer

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#disclaimer)

This exploit is intended for ethical testing within authorized environments, such as responsible disclosure programs or Vulnerability Disclosure Programs (VDPs). The authors are not responsible for misuse or unauthorized actions taken using this script.

---

## Author

[](https://github.com/D3N14LD15K/CVE-2024-11680%5FPoC%5FExploit#author)

**D3N14LD15K**

- d3n14ld15k\[at\]bugcrowdninja\[dot\]com