CVE-2019-12725

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
zeroshellzeroshell
3.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
https://zeroshell.org/blog/
http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
https://zeroshell.org/blog/