cve/2022/CVE-2022-36537.md

### [CVE-2022-36537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36537)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

### POC

#### Reference
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Malwareman007/CVE-2022-36537
- https://github.com/Mr-xn/Penetration_Testing_POC
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/agnihackers/CVE-2022-36537-EXPLOIT
- https://github.com/k0mi-tg/CVE-POC
- https://github.com/k8gege/Ladon
- https://github.com/lions2012/Penetration_Testing_POC
- https://github.com/manas3c/CVE-POC
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/numencyber/Vulnerability_PoC
- https://github.com/rggu2zr/rggu2zr
- https://github.com/sponkmonk/Ladon_english_update
- https://github.com/whoforget/CVE-POC
- https://github.com/youwizard/CVE-POC