cve/cves/2012/CVE-2012-10039.md at main

admin/cve

0 Fork 0

mirror of https://github.com/0xMarcio/cve.git synced 2026-10-23 16:35:19 +00:00

Files

T

0xMarcio 08d697bd12 Carry each record's title, vendor and product, and search them first

A CVE List V5 record names what it is about: a title such as "PAN-OS:
Arbitrary File Creation Leads to OS Command Injection Vulnerability in
GlobalProtect", a vendor and its products. None of it was kept, so a query
for pan-os or prisma access only found records whose prose happened to say
so. Every record now opens with the title in bold and a Vendor badge per
affected vendor, refreshed from a local CVE List checkout in one pass and
kept current by the daily sync for the records it fetches. Only the lines
above the description move; descriptions and PoC sections are untouched.
The pass also settled the heading link on cve.org and trimmed the stray
space some version badges carried.

The site index carries title, vendor and product for the 40 percent of
indexed CVEs whose records have them. Search scores a hit in those above
any position in the description, results show the title as a headline,
and each page puts it under the CVE id, in the browser title, the meta
description and an Affected row, with the block hubs listing it in place
of the description's opening.

The 35 MB metadata file the homepage needed before anything could be
filtered is split in two for the page: the CVSS rows load with the rest,
the advisories follow the index instead of competing with it for the
connection. cve_metadata.json stays whole for anyone reading the API.

2026-09-04 02:32:22 +02:00

1.7 KiB

Raw Permalink Blame History

CVE-2012-10039

ZEN Load Balancer Filelog Command Execution

Description

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.

POC

Reference

Github

No PoCs found on GitHub currently.

Metasploit

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zen_load_balancer_exec.rb

1.7 KiB Raw Permalink Blame History