CVE-2019-12725 PoC — Zeroshell 操作系统命令注入漏洞

Description

ZeroShell 3.9.0 Remote Command Injection

介绍

# POC CVE-2019-12725-Remote-Command-Execution

ZeroShell 3.9.0 Remote Command Injection

- Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. 

### Exploit Usage

#### Commands:

`$ sudo python ZeroShell_RCE.py -u <Base_Host> `

![](https://github.com/hevox/CVE-2019-12725-Command-Injection/blob/main/imgs/ZeroShell.png)

- References:
  
  https://www.exploit-db.com/exploits/49862
  
  https://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html

  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12725

文件快照

备注