CVE-2019-9041
HIGH NUCLEIZZZCMS zzzphp 1.6.1 - Remote Code Execution via Template Parser If Label
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-9041. PoCs published by Yang Chenglong. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit describes a dynamic code evaluation vulnerability in zzzphp CMS 1.6.1 due to insufficient filtering in the parserIfLabel() function, allowing attackers to inject PHP code into template files. The writeup provides a technical explanation and a proof-of-concept payload but lacks full exploit code.
Description
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.
Exploits (1)
The exploit describes a dynamic code evaluation vulnerability in zzzphp CMS 1.6.1 due to insufficient filtering in the parserIfLabel() function, allowing attackers to inject PHP code into template files. The writeup provides a technical explanation and a proof-of-concept payload but lacks full exploit code.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H