CVE-2018-18787: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie...

PT-2018-14649

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in zzcms where SQL Injection is possible. This occurs in the zs/subzs.php file when a zzcmscpid cookie is used to access the zs/search.php endpoint. Recommendations For zzcms version 8.3, consider...

CVE-2018-18791: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie...

PT-2018-14651

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in zzcms where SQL Injection is possible. This occurs in the zs/zs.php file via the pxzs cookie. Recommendations For zzcms version 8.3, consider restricting access to the zs/zs.php file or removing...

PT-2018-14655

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in zzcms where SQL Injection is possible. This occurs in the zs/search.php file through the pxzs cookie. Recommendations For zzcms version 8.3, consider restricting access to the zs/search.php file...

PT-2018-14648

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in the software where SQL Injection is possible. This occurs in the admin/tagmanage.php file through the tabletag parameter, and it requires an admin user to be logged in. Recommendations For zzcms...

Arbitrary File Deletion Vulnerability in ZZCMS 2018 Version Frontend

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. An arbitrary file deletion vulnerability exists in the frontend of ZZCMS 2018 version. An attacker can exploit the vulnerability to delete arbitrary files...

Arbitrary file deletion vulnerability in ZZCMS 2018 version frontend (CNVD-2018-23353)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. An arbitrary file deletion vulnerability exists in the frontend of ZZCMS 2018 version. An attacker can exploit the vulnerability to delete arbitrary files...

SQL Injection Vulnerability in ZZCMS fu***.php Page

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ZZCMS fu.php page. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Directory traversal

An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17797

An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17798

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17797

An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

Design/Logic Flaw

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17798

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17797

CVE-2018-17797 affects zzcms 8.3. The issue is in user/zssave.php where remote attackers can delete arbitrary files by traversing directories via the oldimg parameter in an action=modify request, potentially enabling database access by removing install.lock. This describes a directory traversal v...

CVE-2018-17798

The CVE-2018-17798 issue affects zzcms 8.3: user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter within an action=modify request. This can be leveraged to delete install.lock, enabling database access or further compromise. Reported ...

CVE-2018-17797

An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17798

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-17798: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...