PT-2022-6559 · Zzcms · Zzcms

Yuan Lirong · Published 2022-09-10 · Updated 2022-09-23 · CVE-2022-40446

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZZCMS version 2022

Description The issue is related to a SQL injection vulnerability in the ZZCMS system, specifically in the admin/sendmailto.php component. This vulnerability arises from the lack of protection against SQL query structure manipulation when handling the tomail and groupid parameters. An attacker can exploit this vulnerability to execute arbitrary SQL code remotely.

Recommendations For ZZCMS version 2022, as a temporary workaround, consider restricting access to the /admin/sendmailto.php component until a patch is available. Avoid using the tomail and groupid parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-02411

CVE-2022-40446

Affected Products

Zzcms

References · 6

• 🔥 https://github.com/liong007/ZZCMS/issues/4 · Exploit
• https://bdu.fstec.ru/vul/2023-02411 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40446 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40446 · Vendor Advisory
• https://t.me/cibsecurity/50263 · Telegram Post
• https://vuldb.com/ru/?id.209308 · Note