PT-2019-11962 · Zzcms · Zzcms

Kyrie403 · Publicado 2019-03-30 · Atualizado 2019-04-01 · CVE-2019-10647

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.6.3

Description The issue allows remote attackers to execute arbitrary PHP code via a .php URL in the "plugins/ueditor/php/controller.php?action=catchimage" API endpoint, specifically through the source[] parameter, due to a lack of restrictions in inc/zzz file.php. This can be exploited by providing a URL such as "http://192.168.0.1/test.php" if the web server at 192.168.0.1 does not interpret .php files and instead sends their contents.

Recommendations For ZZZCMS zzzphp version 1.6.3, consider restricting access to the "plugins/ueditor/php/controller.php?action=catchimage" API endpoint and limiting the use of the source[] parameter until a patch is available. Additionally, ensure that any web server used in conjunction with this software interprets .php files correctly to prevent exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-10647

Produtos afetados

Zzcms

Referências · 3

• 🔥 https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-10647 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10647 · Nota de Segurança