PT-2022-11550 · Unknown · Zenario Cms

Hieuminhnv · Published 2022-03-14 · Updated 2022-05-24 · CVE-2021-42171

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zenario CMS version 9.0.54156

Description The issue allows an attacker to compromise the web server by uploading and executing a web-shell, which can be used to run commands, browse system files, browse local resources, attack other servers, and exploit local vulnerabilities.

Recommendations For Zenario CMS version 9.0.54156, consider restricting file upload capabilities to prevent the execution of malicious scripts until a fix is available. As a temporary workaround, monitor file uploads closely and restrict access to sensitive system files and resources.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-42171

GHSA-RGG3-3WH7-W935

Affected Products

Zenario Cms

References · 10

• 🔥 https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/2 · Exploit
• 🔥 https://exploit-db.com/exploits/50850 · Exploit
• 🔥 http://packetstormsecurity.com/files/166617/Zenario-CMS-9.0.54156-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42171 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42171 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rgg3-3wh7-w935 · Vendor Advisory
• https://github.com/TribalSystems/Zenario/releases/tag/9.0.55141 · Note
• https://github.com/TribalSystems/Zenario/commit/4566d8a9ac6755f098b3373252fdb17754a77007 · Note
• https://github.com/TribalSystems/Zenario · Note
• https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 · Note