CVE-2019-12725

EUVD-2019-4316
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
zeroshellzeroshell
3.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
https://zeroshell.org/blog/
http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html
http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html
https://www.tarlogic.com/advisories/zeroshell-rce-root.txt
https://zeroshell.org/blog/