PT-2024-30251 · Zzcms · Zzcms

Published 2024-08-16 · Updated 2024-08-19 · CVE-2024-43005

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZZCMS version 2023

Description A reflected cross-site scripting (XSS) issue in the dl liuyan save.php component allows attackers to execute arbitrary code in the context of a user's browser by injecting a crafted payload. This enables the execution of malicious scripts, potentially leading to unauthorized actions or data theft.

Recommendations For ZZCMS version 2023, update the dl liuyan save.php component to prevent reflected cross-site scripting attacks, ensuring that user input is properly sanitized to prevent code injection. As a temporary workaround, consider restricting access to the dl liuyan save.php component until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43005

Affected Products

Zzcms

References · 7

• 🔥 https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43005%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS2.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-43005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43005 · Security Note
• https://twitter.com/CVEnew/status/1824534428925714704 · Twitter Post
• https://t.me/cvedetector/3371 · Telegram Post
• http://zzcms.net · Note
• https://twitter.com/VulmonFeeds/status/1824574737508430197 · Twitter Post