Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Advisories

severity: high
date: December 15, 2025
Affecting: Zomplog 3.9
CVE: CVE-2023-53888
CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS: 7.2
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-51624
Zomplog Archived Product Webpage
Credit: Mirabbas Ağalarov
Description: Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and rename actions in the application.