CVE-2019-12725 PoC — Zeroshell 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-12725.yaml

Associated Vulnerability

Title:Zeroshell 操作系统命令注入漏洞 (CVE-2019-12725)
Description:Zeroshell是一套面向服务器和嵌入式系统的Linux发行版。 Zeroshell 3.9.0版本中存在安全漏洞，该漏洞源于程序没有正确处理HTTP参数。攻击者可通过注入操作系统命令利用该漏洞执行命令。

Description

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

File Snapshot


 id: CVE-2019-12725

info:
  name: Zeroshell 3.9.0 - Remote Command Execution
  author: dwisiswant0,a

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!