.. / CVE-2019-9041

Exploit for ZZZCMS 1.6.1 - Remote Code Execution (CVE-2019-9041)

Description:

ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzz_template.php file because the parserIfLabel() function’s filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring.

Nuclei Template

View the template here CVE-2019-9041.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-9041.yaml
Copy

References:

https://github.com/Elsfa7-110/kenzer-templates
https://www.exploit-db.com/exploits/46454/
http://www.iwantacve.cn/index.php/archives/118/
https://nvd.nist.gov/vuln/detail/CVE-2019-9041
https://github.com/sobinge/nuclei-templates