PT-2019-19420 · Zzcms · Zzcms

Published 2019-02-26 · Updated 2025-12-08 · CVE-2019-9182

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.6.1

Description The issue allows for PHP code injection through a CSRF attack. This is achieved by sending a request to the "/admin015/save.php?act=editfile" endpoint, where an attacker can provide a filename in the file parameter and malicious file content in the filetext parameter.

Recommendations For ZZZCMS zzzphp version 1.6.1, as a temporary workaround, consider restricting access to the "/admin015/save.php?act=editfile" endpoint to minimize the risk of exploitation. Avoid using the file and filetext parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-9182

Affected Products

Zzcms

References · 6

• 🔥 http://iwantacve.cn/index.php/archives/119 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9182 · Security Note
• https://exploit-db.com/exploits/46488 · Note
• https://t.me/cveNotify/145157 · Telegram Post
• https://packetstorm.news/files/id/151967 · Note