EIP-2026-114615
PRE-CVEZentao Project Management System 17.0 - Authenticated Remote Code Execution (RCE)
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-114615. PoCs published by mister0xf.
AI-analyzed exploit summary This exploit demonstrates an authenticated command injection vulnerability in Zentao Project Management System 17.0, allowing remote code execution via the 'client' parameter in a POST request to the repo creation endpoint. The exploit authenticates, then injects a command into the 'client' field, which is executed via the 'exec' function in the vulnerable PHP code.
Description
Zentao Project Management System 17.0 - Authenticated Remote Code Execution (RCE)
Exploits (1)
This exploit demonstrates an authenticated command injection vulnerability in Zentao Project Management System 17.0, allowing remote code execution via the 'client' parameter in a POST request to the repo creation endpoint. The exploit authenticates, then injects a command into the 'client' field, which is executed via the 'exec' function in the vulnerable PHP code.