PT-2018-18747 · Zzcms · Zzcms

Ni9Htmar3 · Publicado 2018-03-24 · Atualizado 2022-11-01 · CVE-2018-8968

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 8.2

Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an "action=modify" request to the "user/manage.php" endpoint. This can be leveraged for database access by deleting install.lock.

Recommendations For zzcms version 8.2, restrict access to the "user/manage.php" endpoint to minimize the risk of exploitation, and avoid using the oldimg or oldflv parameters in requests until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-8968

Produtos afetados

Zzcms

Referências · 3

• 🔥 https://github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/manage.php.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-8968 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-8968 · Nota de Segurança