Published: 19/07/2019 Updated: 13/05/2021

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 891

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zeroshell zeroshell 3.9.0

This Metasploit module exploits an unauthenticated command injection vulnerability found in ZeroShell version 390 in the "/cgi-bin/kerbynet" url As sudo is configured to execute /bin/tar without a password (NOPASSWD) it is possible to run root commands using the "checkpoint" tar options ...

ZeroShell version 390 remote command execution exploit ...

ZeroShell 3.9.0 Remote Command Injection

POC CVE-2019-12725-Remote-Command-Execution ZeroShell 390 Remote Command Injection Zeroshell 390 is prone to a remote command execution vulnerability Specifically, this issue occurs because the web application mishandles a few HTTP parameters An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters Exploit Usage Comma

xray poc.yml 执行器

xray poc 执行器仅供个人学习、研究使用，请勿用于非法用途使用 Releases页面包含最新下载地址 # curl -L githubcom/raylax/rayx/releases/download/010/rayx_darwin_amd64 -o rayx chmod +x rayx /rayx -p _testdata/pocs -u localhost:1234 # zeroshell-cve-2019-12725-rceyml - [H] √√√ # zimbra-cve-2019-9670-xxeym

CVE-2019-12725 ZeroShell 远程命令执行漏洞

CVE-2019-12725 CVE-2019-12725 ZeroShell 远程命令执行漏洞 =================================================== 自己的练习项目

CWE-78 https://zeroshell.org/blog/https://www.tarlogic.com/advisories/zeroshell-rce-root.txt http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html https://nvd.nist.gov https://github.com/hevox/CVE-2019-12725-Command-Injection https://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html

CVE-2019-12725

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect