PT-2019-19351 · Zzcms · Zzcms

Published 2019-02-24 · Updated 2019-02-25 · CVE-2019-9078

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zzcms version 2019

Description The issue concerns a security problem where an attacker can execute arbitrary code. This is possible due to the lack of proper input validation in the ask.php file when the do parameter is set to modify. Specifically, the inc/stopsqlin.php script fails to block mixed-case strings, such as sCrIpT, allowing for potential exploitation.

Recommendations For zzcms version 2019, consider restricting access to the ask.php file, specifically when the do parameter is set to modify, until a proper fix is applied. As a temporary workaround, ensure that all input to the ask.php file is thoroughly validated to prevent malicious code execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9078

Affected Products

Zzcms

References · 3

• 🔥 https://github.com/NS-Sp4ce/ZZCMS-XSS/blob/master/xss.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-9078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9078 · Security Note