id: CVE-2026-102489

info:
  name: Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution
  author: Abdullah Shahid (comradezephyr)
  severity: critical
  description: |
    Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.
  impact: |
    Remote attackers can execute code as the zammad user, potentially compromising the system.
  remediation: |
    Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.
  reference:
    - https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490
    - https://csirt.divd.nl/CVE-2026-102489
    - https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/
    - https://github.com/horizon3ai/CVE-2026-102489
    - https://nvd.nist.gov/vuln/detail/CVE-2026-102489
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-102489
    epss-score: 0.22478
    epss-percentile: 0.97706
    cwe-id: CWE-384
  metadata:
    verified: true
    max-request: 1
    vendor: zammad
    product: zammad
    shodan-query: http.title:"zammad helpdesk"
    fofa-query: title="Zammad"
  tags: cve,cve2026,zammad,websocket,session,rce,kev,vkev

websocket:
  - address: "{{Scheme}}://{{Hostname}}/ws"

    inputs:
      - data: '{"event":"base"}'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(response, "undefined method", "Sessions::Event::Base")'
          - 'contains(response, "@clients")'
        condition: and
# digest: 4a0a00473045022100ca192a01a628fb302db3ea58871c818da77398bd717d934eaa15231418f002d302203763ff9a121d897c516908116240c2c7855312cc16ef8600d1b70bc0c2a0a0be:922c64590222798bb761d5b6d8e72950