PT-2025-4750 · Zzcms · Zzcms

Published 2025-01-31 · Updated 2025-01-31 · CVE-2025-22957

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZZCMS versions <= 2023

Description A SQL injection issue exists in the front-end of the website, which can be exploited without any authentication. This could potentially allow attackers to gain unauthorized access to the database and extract sensitive information.

Recommendations For ZZCMS versions <= 2023, consider restricting access to the front-end of the website until a patch is available. As a temporary workaround, review and modify the SQL queries to prevent injection attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-22957

Affected Products

Zzcms

References · 6

• 🔥 https://github.com/youyouiooi/vulnerability-reports/blob/main/CVE-2025-22957/REANDE.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-22957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22957 · Security Note
• http://zzcms.net · Note
• https://twitter.com/CVEnew/status/1885370172393087144 · Twitter Post
• https://t.me/cvedetector/16958 · Telegram Post