PT-2019-19351 · Zzcms · Zzcms

Publicado 2019-02-24 · Atualizado 2019-02-25 · CVE-2019-9078

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 2019

Description The issue concerns a security problem where an attacker can execute arbitrary code. This is possible due to the lack of proper input validation in the ask.php file when the do parameter is set to modify. Specifically, the inc/stopsqlin.php script fails to block mixed-case strings, such as sCrIpT, allowing for potential exploitation.

Recommendations For zzcms version 2019, consider restricting access to the ask.php file, specifically when the do parameter is set to modify, until a proper fix is applied. As a temporary workaround, ensure that all input to the ask.php file is thoroughly validated to prevent malicious code execution.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-9078

Produtos afetados

Zzcms

Referências · 3

• 🔥 https://github.com/NS-Sp4ce/ZZCMS-XSS/blob/master/xss.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-9078 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9078 · Nota de Segurança