Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Zena-CVE-2021-45026 — Proof-of-concept exploit for CVE-2021-45026 targeting Rocket Software Zena. Chains stored XSS to remote code execution via REST API task injection on the webconfig interface. | Kitploit
Tools/GitHubGitHub/jetp1ane/zena-cve-2021-45026
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubjetp1ane/zena-cve-2021-45026

Zena-CVE-2021-45026

Proof-of-concept exploit for CVE-2021-45026 targeting Rocket Software Zena. Chains stored XSS to remote code execution via REST API task injection on the webconfig interface.

View Repository
415 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Zena - Stored XSS to RCE Exploit POC

Exploit POC for Rocket Software's Zena application v. 4.2.1 - Stored XSS to RCE

CVE-2021-45025

CVE-2021-45026

https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html

POC Process:

  • Logs into Zena's webconfig page using default credentials
  • Drops Stored XSS payload
  • Payload needs to be triggered by someone navigating to the webconfig page
  • Triggered payload uses REST API backend of Zena to find an agent and build a Task for that agent
  • Task is then triggered for agent thus executing the specified command

To Run:

  • python CookieMonster.py <hostname/ip> <TLS/SSL - True or False> <cmd.exe command>
    • Example: python3 CookieMonster.py 127.0.0.1 False "/c whoami > c:/out.txt"
Download Tool