CVE-2019-12725 PoC — Zeroshell 操作系统命令注入漏洞

Source

https://github.com/gougou123-hash/CVE-2019-12725

Associated Vulnerability

Title:Zeroshell 操作系统命令注入漏洞 (CVE-2019-12725)
Description:Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

Description

ZeroShell命令执行漏洞批量扫描poc+exp

Readme

# CVE-2019-12725
ZeroShell存在命令执行漏洞，导致攻击者可执行任意命令


## 工具利用

python3 CVE-2019-12725.py -u http://127.0.0.1:1111 单个url测试

python3 CVE-2019-12725.py -c http://127.0.0.1:1111 cmdshell模式

python3 CVE-2019-12725.py -f url.txt 批量检测

![](./exp.png)

## 免责声明

由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!