PT-2019-19018 · Zzcms · Zzcms

615 · Published 2019-02-17 · Updated 2019-02-19 · CVE-2019-8411

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 2018

Description The issue allows remote attackers to delete arbitrary files via a directory traversal attack. This is achieved by exploiting the action and filename parameters in the admin/dl data.php file. Specifically, the filename parameter is vulnerable to directory traversal attacks, allowing an attacker to access and delete files outside of the intended directory.

Recommendations For zzcms version 2018, restrict access to the admin/dl data.php file to minimize the risk of exploitation. As a temporary workaround, consider disabling the file deletion functionality in this file until a patch is available. Avoid using the filename parameter in the admin/dl data.php file with untrusted input until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-8411

Affected Products

Zzcms

References · 3

• 🔥 https://github.com/615/VulnPoC/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2019-8411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8411 · Security Note