PT-2025-24614 · Zendto · Zendto

Pnshbr · Published 2025-06-10 · Updated 2025-06-17 · CVE-2025-5952

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zend.To versions 6.10-6 Beta and earlier

Description A critical vulnerability has been found in Zend.To, affecting the function exec of the file NSSDropoff.php. The manipulation of the argument file 1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This issue affects a rather old version of the software. The vendor recommends updating to the latest release.

Recommendations To address this issue, upgrade to version 6.10-7 or later. As a temporary workaround, consider disabling the exec function in the NSSDropoff.php file until a patch is available. Restrict access to the vulnerable file to minimize the risk of exploitation. Avoid using the file 1 argument in the affected function until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-5952

Affected Products

Zendto

References · 11

• 🔥 https://matheuscezar.github.io/2025/05/24/0-day-in-zend-to.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5952 · Security Note
• https://t.me/cvetracker/25871 · Telegram Post
• https://vuldb.com/?id.311789 · Note
• https://twitter.com/CVEnew/status/1932311147065045465 · Twitter Post
• https://vuldb.com/?submit.589178 · Note
• https://vuldb.com/?ctiid.311789 · Note
• https://t.me/latest_high_impact_cve/2600 · Telegram Post
• https://t.me/cvenotify/125207 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1932313228245168439 · Twitter Post
• https://twitter.com/SecAideInfo/status/1934918008851583424 · Twitter Post