CVE-2022-27925 PoC — Zimbra Collaboration Suite 路径遍历漏洞

Source

https://github.com/Inplex-sys/CVE-2022-27925

Associated Vulnerability

Title: Zimbra Collaboration Suite 路径遍历漏洞 (CVE-2022-27925)
Description:Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Description

A loader for zimbra 2022 rce (cve-2022-27925)

Readme

# CVE-2022-27925 (Zimbra RCE 2022)

This repo is part of the ***hgrab-framework***

### dork
`title: "<title>Zimbra Web Client Sign In</title>"`

### Affected product
  - Zimbra Collaboration Suite Network Edition 9.0.0 Patch 23 (and earlier)
  - Zimbra Collaboration Suite Network Edition 8.8.15 Patch 30 (and earlier)

### Installation
Install the app on the server
```sh
user@domain:~# git clone https://github.com/Inplex-sys/CVE-2022-27925.git
user@domain:~# cd ./CVE-2022-27925/
user@domain:~# python3 main.py <list.txt> <output> <command>
```

The list file must contain the targets servers with this format `<http-https>://<target>:<port>`

![image](https://user-images.githubusercontent.com/69421356/193409368-c3b2139c-ec37-4261-9536-e43ea8102146.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →