CVE-2019-12725

CVE-2019-12725 ZeroShell has a command execution vulnerability that allows attackers to execute arbitrary commands Tool Usage python3 CVE-2019-12725.py -u http://127.0.0.1:1111 Single URL test python3 CVE-2019-12725.py -c http://127.0.0.1:1111 cmdshell mode python3 CVE-2019-12725.py -f url.txt...

CVE-2019-12725-Command-Injection

POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 Remote Command Injection Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this iss...

ZeroShell <= 1.0beta11 Remote Code Execution

ZeroShell 1.0beta11 and earlier via cgi-bin/kerbynet allows remote attackers to execute arbitrary commands through shell metacharacters in the type parameter in a NoAuthREQ x509List action. id: CVE-2009-0545 info: name: ZeroShell = 1.0beta11 Remote Code Execution author: geeknik severity: critica...

Zeroshell 3.9.0 - Remote Command Execution

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. id: CVE-2019-12725 info...

Zeroshell 3.9.3 - Command Injection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. id: CVE-2020-29390 info: name: Zeroshell 3.9.3 - Command...

CVE-2019-12725

CVE-2019-12725 CVE-2019-12725 ZeroShell Remote Command Execution Vulnerability =================================================== My own practice project...

Zeroshell kerbynet RCE (CVE-2020-29390)

Exploits CVE-2020-29390 in Zeroshell 3.9.3: shell metacharacter injection via ampersand-wrapped commands in StartSessionSubmit User parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet ampersand injection CVE-2020-29390.""" import re import urllib.parse from kittysploit impo...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

ZeroShell - kerbynet LFI Detection

Detects ZeroShell 2.0RC2 LFI via /cgi-bin/kerbynet?Section=NoAuthREQ&Action=Render&Object=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell kerbynet local file inclusion / command chain.""" import re from kittysploit import from lib.protocols.http.httpclient import...

ZeroShell - kerbynet File Read

Reads arbitrary files via ZeroShell kerbynet NoAuthREQ Render Object traversal. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell kerbynet file read / command via LFI chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Zeroshell 3.9.3 - Command Injection Detection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell 3."...

Zeroshell 3.9.0 - Remote Command Execution Detection

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. !/usr/bin/env python3 -...

ZeroShell Panel - Detect

ZeroShell panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ZeroShell Panel - Detect', 'description': 'ZeroShell panel was...

CVE-2019-12725

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters...

EUVD-2021-28750

Malicious code in bioql PyPI...

VulnCheck KEV: CVE-2020-29390

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character...

CVE-2021-41738

ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands...

CVE-2020-29390

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character...

Zeroshell vulnerable to OS command injection

Overview The web interface of Zeroshell, Linux distribution provided by Zeroshell.org, contains an OS command injection vulnerability CWE-78. Hirukawa Norihiko of MYT Consulting Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

JVN#44033918: Zeroshell vulnerable to OS command injection

The web interface of Zeroshell, Linux distribution provided by Zeroshell.org, contains an OS command injection vulnerability CWE-78. Impact Processing a crafted HTTP request may lead to an arbitrary OS command execution. Solution Stop using the product The developer states that the affected produ...