Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-53888. PoCs published by Mirabbas Ağalarov.
AI-analyzed exploit summary This exploit demonstrates a Remote Code Execution (RCE) vulnerability in zomplog 3.9 by leveraging file upload and rename functionality to execute arbitrary PHP code. The exploit authenticates, injects malicious PHP code into a configuration file, renames it to a .php extension, and triggers execution.
Description
Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.
Exploits (1)
This exploit demonstrates a Remote Code Execution (RCE) vulnerability in zomplog 3.9 by leveraging file upload and rename functionality to execute arbitrary PHP code. The exploit authenticates, injects malicious PHP code into a configuration file, renames it to a .php extension, and triggers execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H