CVE-2019-12725

critical

Description

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.

References

Exploits
More

https://securityaffairs.com/164838/breaking-news/excobalt-cybercrime-group-targets-russian-orgs.html

https://blog.xlab.qianxin.com/catddos-derivative-en/

https://zeroshell.org/blog/

https://www.tarlogic.com/advisories/zeroshell-rce-root.txt

http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html

http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html

Details

Source: Mitre, NVD

Published: 2019-07-19

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.89849