cve/2019/CVE-2019-12725.md

### [CVE-2019-12725](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12725)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

### POC

#### Reference
- http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
- https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
- https://www.tarlogic.com/advisories/zeroshell-rce-root.txt

#### Github
- https://github.com/0day404/vulnerability-poc
- https://github.com/20142995/Goby
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/ArrestX/--POC
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/HimmelAward/Goby_POC
- https://github.com/KayCHENvip/vulnerability-poc
- https://github.com/Miraitowa70/POC-Notes
- https://github.com/MzzdToT/CVE-2019-12725
- https://github.com/MzzdToT/HAC_Bored_Writing
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Sma11New/PocList
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Z0fhack/Goby_POC
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/givemefivw/CVE-2019-12725
- https://github.com/gougou123-hash/CVE-2019-12725
- https://github.com/h3v0x/CVE-2019-12725-Command-Injection
- https://github.com/hev0x/CVE-2019-12725-Command-Injection
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/merlinepedra25/nuclei-templates
- https://github.com/raylax/rayx
- https://github.com/sma11new/PocList
- https://github.com/sobinge/nuclei-templates
- https://github.com/warriordog/little-log-scan