PT-2025-39186 · Csz Cms · Csz Cms

Published 2025-09-23 · Updated 2025-09-23 · CVE-2025-29083

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CSZ-CMS version 1.3.0

Description A SQL Injection issue exists in CSZ-CMS version 1.3.0. This allows a remote attacker to execute arbitrary code through the execSqlFile function located in the Plugin Manager.php file. The vulnerability is triggered by manipulating SQL queries.

Recommendations Update CSZ-CMS to a newer version that addresses this issue. As a temporary workaround, restrict access to the Plugin Manager.php file. Avoid using the execSqlFile function until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-29083

Affected Products

Csz Cms

References · 6

• 🔥 https://github.com/fax77829yz/CSZ_CMS-exploit/blob/main/README.md#cve2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29083 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29083 · Vendor Advisory
• https://twitter.com/CVEnew/status/1970621827627262051 · Twitter Post
• https://t.me/CVEtracker/33176 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1970605870040957126 · Twitter Post