Command injection

2020-08-0616:15:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.9%

JSON

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its ‘/pro/repo-create.html’ component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter ‘path’, and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

CPENameOperatorVersion
zentao_prole8.8.2

CPE	Name	Operator	Version
	zentao_pro	le	8.8.2

References

github.com/rapid7/metasploit-framework/pull/13828