PT-2018-13504 · Zzcms · Zzcms

Publicado 2018-09-02 · Atualizado 2018-11-13 · CVE-2018-16344

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 8.3

Description An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter, potentially leading to database access by deleting install.lock.

Recommendations For zzcms version 8.3, consider restricting access to the flv parameter to prevent directory traversal attacks until a patch is available. As a temporary workaround, monitor install.lock and other critical files for unauthorized deletion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-16344

Produtos afetados

Zzcms

Referências · 3

• 🔥 https://github.com/cumtxujiabin/CmsPoc/blob/master/zzcms_8.3_file_del.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-16344 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16344 · Nota de Segurança