CVE-2020-7361

CRITICAL

Easycorp Zentao Pro < 8.8.2 - OS Command Injection

Title source: rule

Description

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

Exploits (1)

metasploit WORKING POC EXCELLENT
by Daniel Monzón, Melvin Boers, Erik Wynter · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zentao_pro_rce.rb

References (1)

Scores

CVSS v3 9.6
EPSS 0.3597
EPSS Percentile 97.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Details

CWE
CWE-78
Status published
Products (1)
easycorp/zentao_pro < 8.8.2
Published Aug 06, 2020
Tracked Since Feb 18, 2026