PT-2018-11612

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue allows SQL injection via the tablename parameter in the /user/del.php endpoint after leveraging use of the zzcms ask table. Recommendations For zzcms version 8.3, avoid using the tablename parameter in t...

CVE-2018-13116: Improper Neutralization of Special Elements used in an SQL Command

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

CVE-2018-13056: Improper Input Validation

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

PT-2018-11563

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description A vulnerability exists at the /user/del.php endpoint, allowing an attacker to delete any file by manipulating the zzcms main table and then making an image add request. This can be exploited to gain database acces...