PT-2022-19061 · Zcms · Zcms

Zhendezuile · Published 2022-04-26 · Updated 2022-05-04 · CVE-2022-28521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206

Description A file inclusion issue was discovered in ZCMS, which can be exploited via the "index.php" endpoint with specific parameters, including m, c, and a. The vulnerability is triggered when an attacker manipulates the a parameter, set to sp set config, allowing for potential malicious file inclusion.

Recommendations For ZCMS version v20170206, as a temporary workaround, consider restricting access to the "index.php" endpoint with the m=home, c=home, and a=sp set config parameters until a patch is available. Avoid using the a parameter with the value sp set config in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-28521

Affected Products

Zcms

References · 5

• 🔥 https://github.com/jorycn/thinkphp-zcms/issues/4 · Exploit
• 🔥❌ https://github.com/zhendezuile/bug_report/blob/main/zcms%EF%BC%9Aphp%20file%20inclusion · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-28521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28521 · Security Note
• https://t.me/cibsecurity/41458 · Telegram Post