PT-2018-18988 · Zzcms · Zzcms

Published 2018-04-07 · Updated 2022-11-01 · CVE-2018-9331

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 8.2

Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in the user/adv.php endpoint. This can be leveraged for database access by deleting install.lock.

Recommendations For zzcms version 8.2, consider restricting access to the user/adv.php endpoint to minimize the risk of exploitation, and avoid using the oldimg parameter until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-9331

Affected Products

Zzcms

References · 3

• 🔥 https://github.com/cherryla/zzcms/blob/master/adv.php.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-9331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9331 · Security Note