泽元-ZCMS /invoke 路径存在任意文件读取

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://stack.chaitin.com/vuldb/detail/7551c436-7d20-45e1-9726-e651c7f5cd0c

Related Vulnerabilities

• PoCCVE-2019-10647: ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)
• 天锐绿盾审批系统 /trwfe/service/../invoker/findTenantPage.do SQL 注入漏洞
• 天锐绿盾审批系统 /trwfe/login.jsp/.%2e/invoker/findCategoryPage.do SQL 注入漏洞
• zcms-v3-sqli: zcms v3 sqli
• zzcms-zsmanage-sqli: ZzCMS zsmanage sqli
• ZZZCMS /search/ 代码执行漏洞（CVE-2019-9041）
• PoCCVE-2019-9041: ZZZCMS 1.6.1 - Remote Code Execution
• PoCCVE-2020-20285: ZZcms - Cross-Site Scripting
• PoCCVE-2022-23881: ZZZCMS zzzphp 2.1.0 - Remote Code Execution
• PoCCVE-2022-40443: ZZCMS 2022 - Path Information Disclosure