PT-2019-19018 · Zzcms · Zzcms

615 · Publicado 2019-02-17 · Atualizado 2019-02-19 · CVE-2019-8411

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 2018

Description The issue allows remote attackers to delete arbitrary files via a directory traversal attack. This is achieved by exploiting the action and filename parameters in the admin/dl data.php file. Specifically, the filename parameter is vulnerable to directory traversal attacks, allowing an attacker to access and delete files outside of the intended directory.

Recommendations For zzcms version 2018, restrict access to the admin/dl data.php file to minimize the risk of exploitation. As a temporary workaround, consider disabling the file deletion functionality in this file until a patch is available. Avoid using the filename parameter in the admin/dl data.php file with untrusted input until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-8411

Produtos afetados

Zzcms

Referências · 3

• 🔥 https://github.com/615/VulnPoC/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2019-8411 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8411 · Nota de Segurança