PT-2023-29571 · Zzcms · Zzcms

CVE-2023-45554 · Publicado 2023-10-24 · Atualizado 2024-09-11

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zzzCMS version 2.1.9

Description The issue allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg, gif, and png to jpg, jpeg, gif, png, pphphp. This enables the attacker to potentially upload malicious files.

Recommendations For zzzCMS version 2.1.9, consider restricting the imageext parameter to only allow jpg, jpeg, gif, and png file types until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-45554

Produtos afetados

Zzcms

Referências · 5

• 🔥 https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-45554 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45554 · Nota de Segurança
• https://t.me/cvenotify/94254 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1716945051685704070 · Publicação no Twitter