CVE-2018-13116

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

Sql injection

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

CVE-2018-13116

CVE-2018-13116 describes an SQL injection in zzcms 8.3 via the path /user/del.php when the attacker manipulates the tablename parameter after leveraging the zzcms_ask table. Multiple sources corroborate: NVD entry notes SQLi with a high/critical impact (CVSS v2: 7.5; CVSS v3: 9.8) affecting confi...

CVE-2018-13116

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

SQL Injection Vulnerability in ZZCMS Version 8.3

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in ZZCMS version 8.3. An attacker can exploit the vulnerability to obtain sensitive database information...

PT-2018-11612

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue allows SQL injection via the tablename parameter in the /user/del.php endpoint after leveraging use of the zzcms ask table. Recommendations For zzcms version 8.3, avoid using the tablename parameter in t...

CVE-2018-13116: Improper Neutralization of Special Elements used in an SQL Command

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

Design/Logic Flaw

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

CVE-2018-13056

The CVE-2018-13056 issue affects zzcms 8.3. A vulnerability in /user/del.php allows deleting arbitrary files by inserting a relative path into the zzcms_main table and triggering an img add request, which can be leveraged to delete install.lock and thereby enable access to the database. The conne...

CVE-2018-13056: Improper Input Validation

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

PT-2018-11563

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description A vulnerability exists at the /user/del.php endpoint, allowing an attacker to delete any file by manipulating the zzcms main table and then making an image add request. This can be exploited to gain database acces...

Stored XSS Vulnerability in zzcms v8.2

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. There is a stored xss vulnerability in ZZCMS version 8.2, through which an attacker can steal administrator cookie information, combined with csrf to operate the backend and so on...

Arbitrary File Deletion Vulnerability in zzcms

ZzCMS is the content management system of Webmaster Merchants. An arbitrary file deletion vulnerability exists in user/adv.php in zzcms 8.2. A remote attacker can exploit this vulnerability by deleting arbitrary files via a directory traversal sequence in the oldimg parameter. An attacker can...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

Directory traversal

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...