Description
This module exploits a command injection vulnerability in ZenTao Pro 8.8.2 and earlier versions in order to execute arbitrary commands with SYSTEM privileges.
The module first attempts to authenticate to the ZenTao dashboard. It then tries to execute the payload by submitting fake repositories via the 'Repo Create' function that is accessible from the dashboard via CI>Repo. More precisely, the module sends HTTP POST requests to '/pro/repo-create.html' that inject commands in the vulnerable 'path' parameter which corresponds to the 'Client Path' input field.
Valid credentials for a ZenTao admin account are required. This module has been successfully tested against ZenTao 8.8.1 and 8.8.2 running on Windows 10 (XAMPP server).
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/http/zentao/pro_rcemsf undefined(pro_rce) > show actions ...actions...msf undefined(pro_rce) > set ACTION < action-name >msf undefined(pro_rce) > show options ...show and set options...msf undefined(pro_rce) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub