PT-2024-30253 · Zzcms · Zzcms

Gkdf1Sh · Published 2024-08-16 · Updated 2024-08-19 · CVE-2024-43009

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZZCMS versions 2023 and earlier

Description A reflected cross-site scripting (XSS) issue exists due to the direct insertion of the HTTP REFERER header value into the HTML response without proper sanitization in the user/login.php file at line 24. An attacker can exploit this by tricking a user into visiting a specially crafted URL with a malicious Referer header, potentially leading to the execution of arbitrary JavaScript code in the victim's browser. This could result in session hijacking, defacement, or other malicious activities.

Recommendations For ZZCMS versions 2023 and earlier, as a temporary workaround, consider sanitizing the HTTP REFERER header value before inserting it into the HTML response to prevent the execution of malicious JavaScript code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-43009

Affected Products

Zzcms

References · 7

• 🔥 https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-43009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43009 · Security Note
• https://twitter.com/VulmonFeeds/status/1824576250251239607 · Twitter Post
• https://t.me/cvedetector/3369 · Telegram Post
• https://twitter.com/CVEnew/status/1824534430083387412 · Twitter Post
• http://zzcms.net/about/download.html · Note