Other Systems POCs

Overview

This section covers POCs for various other systems including VMware vCenter, Atlassian Confluence, GitLab, F5 BIG-IP, ThinkPHP, Fortinet, Microsoft products, and more.

VMware

vCenter RCE vulnerabilities

Confluence

OGNL injection RCE

GitLab

ExifTool RCE

F5 BIG-IP

TMUI & iControl RCE

ThinkPHP

PHP framework RCE

Microsoft

Exchange & SMB vulns

Fastjson

Java JSON RCE

JBoss

Deserialization RCE

PHPUnit

PHP testing RCE

VMware vCenter

CVE-2021-21985 - vCenter RCE

CVE-2021-21985

Type	Remote Code Execution
Affected Product	VMware vCenter Server
Discovery Date	May 2021
CVSS Score	9.8 (Critical)

Description: RCE vulnerability in the vSphere Client (HTML5) via the Virtual SAN Health Check plugin. Allows unauthenticated attackers to execute arbitrary commands. Source: pocs_go/VMware/vCenter/CVE_2021_21985.go

CVE-2022-22954 - VMware Workspace ONE RCE

CVE-2022-22954

Type	Remote Code Execution (SSTI)
Affected Product	VMware Workspace ONE Access, Identity Manager
Discovery Date	April 2022
CVSS Score	9.8 (Critical)

Description: Server-side template injection (SSTI) vulnerability allowing unauthenticated RCE. Attack Vector: Template injection in authentication workflow Source: pocs_go/VMware/vCenter/CVE-2022-22954.go

CVE-2022-22972 - Authentication Bypass

CVE-2022-22972

Type	Authentication Bypass
Affected Product	VMware Workspace ONE Access, Identity Manager
Discovery Date	May 2022
CVSS Score	9.8 (Critical)

Description: Authentication bypass leading to privilege escalation and potential RCE. Source: pocs_go/VMware/vCenter/CVE_2022_22972.go

Atlassian Confluence

CVE-2021-26084 - OGNL Injection RCE

CVE-2021-26084

Type	Remote Code Execution (OGNL Injection)
Affected Product	Atlassian Confluence Server/Data Center
Discovery Date	August 2021
CVSS Score	9.8 (Critical)

Description: OGNL (Object-Graph Navigation Language) injection vulnerability in Confluence Server and Data Center that allows unauthenticated attackers to execute arbitrary code. Attack Vector: Malicious OGNL expressions in HTTP requests Source: pocs_go/confluence/CVE_2021_26084.go

CVE-2021-26085

Type	Confluence Vulnerability
Affected Product	Atlassian Confluence
Discovery Date	August 2021

Source: pocs_go/confluence/CVE-2021-26085.go

CVE-2022-26134 - OGNL Injection RCE

CVE-2022-26134

Type	Remote Code Execution
Affected Product	Atlassian Confluence Server/Data Center
Discovery Date	June 2022
CVSS Score	9.8 (Critical)

Description: Unauthenticated OGNL injection leading to RCE. Actively exploited in the wild. Source: pocs_go/confluence/CVE_2022_26134.go

CVE-2022-26318

Type	Confluence Vulnerability
Affected Product	Atlassian Confluence
Discovery Date	2022

Source: pocs_go/confluence/CVE_2022_26318.go

GitLab

CVE-2021-22205 - ExifTool RCE

CVE-2021-22205

Type	Remote Code Execution
Affected Product	GitLab CE/EE
Discovery Date	April 2021
CVSS Score	10.0 (Critical)

Description: RCE via ExifTool when processing image files. The vulnerability exists in GitLab’s image upload functionality. Attack Vector: Malicious image file with crafted metadata Exploitation:

Upload crafted image file
ExifTool processes metadata
Arbitrary command execution

Source: pocs_go/gitlab/CVE_2021_22205.go

CVE-2022-2185

Type	GitLab Vulnerability
Affected Product	GitLab
Discovery Date	June 2022

Source: pocs_go/gitlab/CVE-2022-2185.go

F5 BIG-IP

CVE-2020-5902 - TMUI RCE

CVE-2020-5902

Type	Remote Code Execution
Affected Product	F5 BIG-IP
Discovery Date	July 2020
CVSS Score	9.8 (Critical)

Description: Directory traversal and RCE in Traffic Management User Interface (TMUI). Allows unauthenticated attackers to execute arbitrary commands. Vulnerable Component: TMUI (web management interface) Attack Vector: Directory traversal → file read/write → RCE Source: pocs_go/f5/CVE_2020_5902.go

CVE-2021-22986 - iControl REST RCE

CVE-2021-22986

Type	Remote Code Execution
Affected Product	F5 BIG-IP iControl REST
Discovery Date	March 2021
CVSS Score	9.8 (Critical)

Description: Unauthenticated RCE via iControl REST API. Source: pocs_go/f5/CVE_2021_22986.go

CVE-2022-1388 - Authentication Bypass RCE

CVE-2022-1388

Type	Authentication Bypass → RCE
Affected Product	F5 BIG-IP
Discovery Date	May 2022
CVSS Score	9.8 (Critical)

Description: Missing authentication check in iControl REST allows unauthenticated RCE. Exploitation: Manipulate HTTP headers to bypass authentication Source: pocs_go/f5/CVE_2022_1388.go

ThinkPHP

CVE-2019-9082

Type	Remote Code Execution
Affected Versions	< 3.2.4
Discovery Date	February 2019

Description: RCE vulnerability in ThinkPHP framework versions before 3.2.4. Source: pocs_go/ThinkPHP/check.go

CVE-2018-20062

Type	Remote Code Execution
Affected Versions	5.0.23 and earlier, 5.1.31 and earlier
Discovery Date	December 2018
CVSS Score	9.8 (Critical)

Description: RCE via Request class in ThinkPHP 5.x. Source: pocs_go/ThinkPHP/check.go

Fastjson

VER-1262 - Autotype RCE

Fastjson VER-1262

Type	Remote Code Execution
Affected Versions	≤ 1.2.62
Issue	Autotype Deserialization

Description: Fastjson autotype feature allows deserialization of arbitrary Java objects, leading to RCE. Attack Vector: Malicious JSON payload with @type directive Example Payload:

{
  "@type": "java.net.Inet4Address",
  "val": "dnslog.cn"
}

Source: pocs_go/fastjson/check.go

JBoss

CVE-2017-12149 - Deserialization RCE

CVE-2017-12149

Type	Deserialization RCE
Affected Versions	JBoss AS 5.x/6.x
Discovery Date	August 2017
CVSS Score	8.1 (High)

Description: Java deserialization vulnerability in JBoss Application Server. Component: ReadOnlyAccessFilter Source: pocs_go/jboss/CVE_2017_12149.go

PHPUnit

CVE-2017-9841 - RCE

CVE-2017-9841

Type	Remote Code Execution
Affected Versions	4.x < 4.8.28, 5.x < 5.6.3
Discovery Date	June 2017
CVSS Score	9.8 (Critical)

Description: PHPUnit’s eval-stdin.php allows arbitrary PHP code execution when left in production. Vulnerable File: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php Exploitation:

curl -X POST http://target/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php \
  --data '<?php system("id"); ?>'

Source: pocs_go/phpunit/CVE_2017_9841.go

Microsoft Products

CVE-2020-0796 - SMBGhost

CVE-2020-0796 (SMBGhost)

Type	Remote Code Execution
Affected Product	Windows 10, Windows Server 2019
Discovery Date	March 2020
CVSS Score	10.0 (Critical)

Description: Wormable RCE in SMBv3 protocol. Buffer overflow in compression handling. Port: 445 (SMB) Source: pocs_go/ms/CVE-2020-0796.go

CVE-2021-26855 - ProxyLogon

CVE-2021-26855 (ProxyLogon)

Type	SSRF → Authentication Bypass → RCE
Affected Product	Microsoft Exchange Server
Discovery Date	March 2021
CVSS Score	9.8 (Critical)

Description: Part of ProxyLogon chain. SSRF allows bypassing authentication and accessing arbitrary backend resources. Attack Chain: CVE-2021-26855 (SSRF) → CVE-2021-26857 (Deserialization) → CVE-2021-26858 (File Write) → CVE-2021-27065 (File Write) Sources:

pocs_go/ms/CVE_2021_26855.go
pocs_go/ms/exchange/proxylogon.go
pocs_go/ms/exchange/chkproxyshell.go

CVE-2018-14847 - MikroTik RouterOS

CVE-2018-14847

Type	Directory Traversal
Affected Product	MikroTik RouterOS
Discovery Date	July 2018

Description: Directory traversal in MikroTik RouterOS web interface. Source: pocs_go/ms/CVE_2018_14847.go

Fortinet

CVE-2018-13380 - FortiOS SSL VPN

CVE-2018-13380

Type	Path Traversal / Credential Disclosure
Affected Product	Fortinet FortiOS SSL VPN
Discovery Date	May 2019
CVSS Score	9.8 (Critical)

Description: Path traversal vulnerability allows reading system files including plaintext VPN credentials. Source: pocs_go/CVE-2018-13380.go

Open Management Infrastructure

CVE-2021-38647 - OMI RCE

CVE-2021-38647

Type	Remote Code Execution
Affected Product	Open Management Infrastructure (OMI)
Discovery Date	September 2021
CVSS Score	9.8 (Critical)

Description: RCE in Microsoft’s Open Management Infrastructure agent used in Azure. Source: pocs_go/CVE-2021-38647.go

Zabbix

CVE-2022-23131 - Authentication Bypass

CVE-2022-23131

Type	Authentication Bypass
Affected Product	Zabbix
Discovery Date	January 2022

Description: Authentication bypass in Zabbix monitoring system. Source: pocs_go/zabbix/CVE-2022-23131.go

Chinese Software Systems

scan4all also includes POCs for various Chinese software systems commonly used in China:

Seeyon OA

System: Seeyon Office AutomationLocation: pocs_go/seeyon/Description: Multiple vulnerabilities in Seeyon OA system

Tongda OA

System: Tongda Office AutomationLocation: pocs_go/tongda/Description: Multiple vulnerabilities in Tongda OA system

Landray OA

System: Landray EKPCVE: Landray_RCELocation: pocs_go/landray/Landray_RCE.go

Zentao

System: Zentao Project ManagementLocation: pocs_go/zentao/

MCMS

System: MCMS Content ManagementVulnerability: Front Desk SQL InjectionLocation: pocs_go/mcms/Front_Desk_sqlinject.go

Sunlogin

System: Sunlogin Remote ControlLocation: pocs_go/sunlogin/

Usage

# Scan for all vulnerabilities
scan4all -h http://target.com

# Scan specific system
scan4all -h http://vcenter.example.com -poc vmware
scan4all -h http://confluence.example.com -poc confluence

# Test specific CVE
scan4all -h http://target.com -poc CVE-2021-22205

Source Code Structure

pocs_go/
├── VMware/vCenter/          # VMware vCenter vulnerabilities
├── confluence/              # Atlassian Confluence
├── gitlab/                  # GitLab vulnerabilities
├── f5/                      # F5 BIG-IP
├── ThinkPHP/                # ThinkPHP framework
├── fastjson/                # Fastjson library
├── jboss/                   # JBoss Application Server
├── phpunit/                 # PHPUnit testing framework
├── ms/                      # Microsoft products
│   └── exchange/           # Microsoft Exchange
├── seeyon/                  # Seeyon OA
├── tongda/                  # Tongda OA
├── landray/                 # Landray EKP
├── zentao/                  # Zentao PM
├── mcms/                    # MCMS
├── sunlogin/                # Sunlogin
├── zabbix/                  # Zabbix monitoring
├── spark/                   # Apache Spark
└── *.go                     # Root-level POCs

Mitigation General Guidelines

Keep Software Updated

Regularly update all software to the latest stable versions

Network Segmentation

Isolate critical systems from public internet

Enable Authentication

Ensure all services require strong authentication

Monitor Logs

Implement centralized logging and monitoring

Security Assessments

Perform regular vulnerability assessments

Incident Response

Have an incident response plan ready

References

Many of these vulnerabilities are actively exploited in the wild. Ensure affected systems are patched immediately.

CLI Reference

Supported Protocols

POC Database

​Overview

VMware

Confluence

GitLab

F5 BIG-IP

ThinkPHP

Microsoft

Fastjson

JBoss

PHPUnit

​VMware vCenter

​CVE-2021-21985 - vCenter RCE

CVE-2021-21985

​CVE-2022-22954 - VMware Workspace ONE RCE

CVE-2022-22954

​CVE-2022-22972 - Authentication Bypass

CVE-2022-22972

​Atlassian Confluence

​CVE-2021-26084 - OGNL Injection RCE

CVE-2021-26084

​CVE-2021-26085

CVE-2021-26085

​CVE-2022-26134 - OGNL Injection RCE

CVE-2022-26134

​CVE-2022-26318

CVE-2022-26318

​GitLab

​CVE-2021-22205 - ExifTool RCE

CVE-2021-22205

​CVE-2022-2185

CVE-2022-2185

​F5 BIG-IP

​CVE-2020-5902 - TMUI RCE

CVE-2020-5902

​CVE-2021-22986 - iControl REST RCE

CVE-2021-22986

​CVE-2022-1388 - Authentication Bypass RCE

CVE-2022-1388

​ThinkPHP

​CVE-2019-9082

CVE-2019-9082

​CVE-2018-20062

CVE-2018-20062

​Fastjson

​VER-1262 - Autotype RCE

Fastjson VER-1262

​JBoss

​CVE-2017-12149 - Deserialization RCE

CVE-2017-12149

​PHPUnit

​CVE-2017-9841 - RCE

CVE-2017-9841

​Microsoft Products

​CVE-2020-0796 - SMBGhost

CVE-2020-0796 (SMBGhost)

​CVE-2021-26855 - ProxyLogon

CVE-2021-26855 (ProxyLogon)

​CVE-2018-14847 - MikroTik RouterOS

CVE-2018-14847

​Fortinet

​CVE-2018-13380 - FortiOS SSL VPN

CVE-2018-13380

​Open Management Infrastructure

​CVE-2021-38647 - OMI RCE

CVE-2021-38647

​Zabbix

​CVE-2022-23131 - Authentication Bypass

CVE-2022-23131

​Chinese Software Systems

​Usage

​Source Code Structure

​Mitigation General Guidelines

​References

Build docs developers (and LLMs) love

Overview

VMware vCenter

CVE-2021-21985 - vCenter RCE

CVE-2022-22954 - VMware Workspace ONE RCE

CVE-2022-22972 - Authentication Bypass

Atlassian Confluence

CVE-2021-26084 - OGNL Injection RCE

CVE-2021-26085

CVE-2022-26134 - OGNL Injection RCE

CVE-2022-26318

GitLab

CVE-2021-22205 - ExifTool RCE

CVE-2022-2185

F5 BIG-IP

CVE-2020-5902 - TMUI RCE

CVE-2021-22986 - iControl REST RCE

CVE-2022-1388 - Authentication Bypass RCE

ThinkPHP

CVE-2019-9082

CVE-2018-20062

Fastjson

VER-1262 - Autotype RCE

JBoss

CVE-2017-12149 - Deserialization RCE

PHPUnit

CVE-2017-9841 - RCE

Microsoft Products

CVE-2020-0796 - SMBGhost

CVE-2021-26855 - ProxyLogon

CVE-2018-14847 - MikroTik RouterOS

Fortinet

CVE-2018-13380 - FortiOS SSL VPN

Open Management Infrastructure

CVE-2021-38647 - OMI RCE

Zabbix

CVE-2022-23131 - Authentication Bypass

Chinese Software Systems

Usage

Source Code Structure

Mitigation General Guidelines

References