cve/2019/CVE-2019-12725.md

CVE-2019-12725

Description

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

POC

Reference

• http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
• https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
• https://www.tarlogic.com/advisories/zeroshell-rce-root.txt

Github

• https://github.com/0day404/vulnerability-poc
• https://github.com/20142995/Goby
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/ArrestX/--POC
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/HimmelAward/Goby_POC
• https://github.com/KayCHENvip/vulnerability-poc
• https://github.com/Miraitowa70/POC-Notes
• https://github.com/MzzdToT/CVE-2019-12725
• https://github.com/MzzdToT/HAC_Bored_Writing
• https://github.com/SexyBeast233/SecBooks
• https://github.com/Sma11New/PocList
• https://github.com/Threekiii/Awesome-POC
• https://github.com/Z0fhack/Goby_POC
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/givemefivw/CVE-2019-12725
• https://github.com/gougou123-hash/CVE-2019-12725
• https://github.com/h3v0x/CVE-2019-12725-Command-Injection
• https://github.com/hev0x/CVE-2019-12725-Command-Injection
• https://github.com/merlinepedra/nuclei-templates
• https://github.com/merlinepedra25/nuclei-templates
• https://github.com/raylax/rayx
• https://github.com/sma11new/PocList
• https://github.com/sobinge/nuclei-templates
• https://github.com/warriordog/little-log-scan