Sql injection

BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidumap parameters in /user/ztconfig.php...

PT-2022-12038

Name of the Vulnerable Software and Affected Versions BaiCloud-cms version 2.5.7 Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities can be exploited via the tongji and baidu map parameters in the "/user/ztconfig.php" API endpoint. Recommendations For...

CVE-2021-44302: Improper Neutralization of Special Elements used in an SQL Command

BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidumap parameters in /user/ztconfig.php...

ZZCMS SQL Injection Vulnerability (CNVD-2022-56484)

ZZCMS is a content management system CMS from the Zzcms team in China. zzcms 2019 suffers from a SQL injection vulnerability. The vulnerability originates from user/ztconfig.php SQL injection via the dohang or img POST parameter. No detailed vulnerability details are currently available...

CVE-2019-12348

An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter...

CVE-2019-12348: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter...

PT-2021-8901

Name of the Vulnerable Software and Affected Versions zzcms version 2019 Description An issue exists in zzcms 2019 where SQL Injection is possible. This occurs in the user/ztconfig.php file via the daohang or img POST parameters. Recommendations For zzcms version 2019, consider restricting access...

Design/Logic Flaw

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

PT-2018-14201

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue was discovered that allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request to the "user/ztconfig.php" endpoint. This can be leverage...

CVE-2018-17798: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...