PT-2019-11962 · Zzcms · Zzcms

Kyrie403 · Published 2019-03-30 · Updated 2019-04-01 · CVE-2019-10647

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.6.3

Description The issue allows remote attackers to execute arbitrary PHP code via a .php URL in the "plugins/ueditor/php/controller.php?action=catchimage" API endpoint, specifically through the source[] parameter, due to a lack of restrictions in inc/zzz file.php. This can be exploited by providing a URL such as "http://192.168.0.1/test.php" if the web server at 192.168.0.1 does not interpret .php files and instead sends their contents.

Recommendations For ZZZCMS zzzphp version 1.6.3, consider restricting access to the "plugins/ueditor/php/controller.php?action=catchimage" API endpoint and limiting the use of the source[] parameter until a patch is available. Additionally, ensure that any web server used in conjunction with this software interprets .php files correctly to prevent exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-10647

Affected Products

Zzcms

References · 3

• 🔥 https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-10647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10647 · Security Note