PT-2025-51982 · Zzcms · Zzcms

Airrudder · Published 2025-12-17 · Updated 2025-12-30 · CVE-2025-14837

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZZCMS version 2025

Description A code injection issue exists in ZZCMS 2025, specifically within the Backend Website Settings Module. The stripfxg function in the /admin/siteconfig.php file is affected. Manipulation of the icp argument can lead to code injection, and the attack can be executed remotely. The exploit has been publicly disclosed.

Recommendations Apply any available updates to address the issue in the stripfxg function of the /admin/siteconfig.php file. As a temporary workaround, restrict access to the /admin/siteconfig.php file to minimize the risk of exploitation. Avoid using the icp parameter in the affected function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-14837

Affected Products

Zzcms

References · 11

• 🔥 https://note-hxlab.wetolink.com/share/ekNgcv2wVBya · Exploit
• https://osv.dev/vulnerability/CVE-2025-14837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14837 · Security Note
• https://t.me/cveNotify/146141 · Telegram Post
• https://vuldb.com/?id.336987 · Note
• https://twitter.com/CVEnew/status/2002487765850861678 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001593109340168573 · Twitter Post
• https://t.me/CVEtracker/40105 · Telegram Post
• https://vuldb.com/?submit.711655 · Note
• https://vuldb.com/?ctiid.336987 · Note
• https://t.me/cveNotify/147201 · Telegram Post