PT-2018-13504 · Zzcms · Zzcms

Published 2018-09-02 · Updated 2018-11-13 · CVE-2018-16344

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 8.3

Description An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter, potentially leading to database access by deleting install.lock.

Recommendations For zzcms version 8.3, consider restricting access to the flv parameter to prevent directory traversal attacks until a patch is available. As a temporary workaround, monitor install.lock and other critical files for unauthorized deletion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-16344

Affected Products

Zzcms

References · 3

• 🔥 https://github.com/cumtxujiabin/CmsPoc/blob/master/zzcms_8.3_file_del.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-16344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16344 · Security Note