Zomplog version 3.9 is susceptible to remote code execution, which could allow an authenticated attacker to gain full control of the application.

This is a code injection vulnerability (CWE-94) requiring high-privileged authentication. An attacker can manipulate files to trigger the execution of arbitrary code on the server.

The CVSS score of 8.8 reflects the high risk of total system compromise. An attacker with administrative access can leverage this flaw to execute code, leading to unauthorized data access, system modification, or persistent backdoors within the server environment.

Immediate Action: Verify if a patch is available from the vendor and apply it immediately; otherwise, restrict administrative access to the Zomplog interface.

Proactive Monitoring: Audit server logs for unauthorized file modifications or suspicious execution patterns originating from administrative accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing suspicious code injection patterns targeting the file management functions of the application.

Public Exploit Available: Yes — an exploit is available via ExploitDB (ID 51624).

Given the availability of public exploit code and the critical nature of remote code execution, this vulnerability must be addressed urgently. Ensure that only trusted personnel have administrative access and apply all available security updates provided by the vendor.