PT-2024-30255 · Zzcms · Zzcms

Gkdf1Sh · Published 2024-08-16 · Updated 2024-08-19 · CVE-2024-43011

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZZCMS versions 2023 and earlier

Description An arbitrary file deletion issue exists due to insufficient validation and sanitization of user input for file paths in the admin/del.php file at line 62. This allows an attacker to use directory traversal techniques to delete arbitrary files on the server, potentially disrupting system operation.

Recommendations For ZZCMS versions 2023 and earlier, as a temporary workaround, consider restricting access to the admin/del.php file until a patch is available. Additionally, ensure proper validation and sanitization of user input for file paths to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-43011

Affected Products

Zzcms

References · 7

• 🔥 https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43011%20ZZCMS2023%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-43011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43011 · Security Note
• https://twitter.com/VulmonFeeds/status/1824577006823932002 · Twitter Post
• http://zzcms.net/about/download.html · Note
• https://t.me/cvedetector/3370 · Telegram Post
• https://twitter.com/CVEnew/status/1824534431270379602 · Twitter Post