PT-2023-29571 · Zzcms · Zzcms

Published 2023-10-24 · Updated 2024-09-11 · CVE-2023-45554

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zzzCMS version 2.1.9

Description The issue allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg, gif, and png to jpg, jpeg, gif, png, pphphp. This enables the attacker to potentially upload malicious files.

Recommendations For zzzCMS version 2.1.9, consider restricting the imageext parameter to only allow jpg, jpeg, gif, and png file types until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-45554

Affected Products

Zzcms

References · 5

• 🔥 https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-45554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45554 · Security Note
• https://t.me/cvenotify/94254 · Telegram Post
• https://twitter.com/CVEnew/status/1716945051685704070 · Twitter Post