CVE-2018-9331

CVE-2018-9331 affects zzcms 8.2. The vulnerability is in the user/adv.php endpoint, where the oldimg parameter allows directory traversal to delete arbitrary files. This can be exploited to delete install.lock, potentially enabling access to the database. Public sources in CNVD/Curated CVE entrie...

PT-2018-18988 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in the user/adv.php endpoint. This can be leveraged for database access by...

CVE-2018-9331: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

Sql injection

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

CVE-2018-9309 affects zzcms 8.2, where the id parameter in the dl/dl_sendsms.php request enables SQL injection. The NVD entry documents a high‑risk flaw with CVSS v3.1 base score 9.8 (NETWORK, LOW complexity, no privileges, UI/N user interaction, with HIGH impact on confidentiality, integrity, an...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

PT-2018-18966 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...

CVE-2018-9309: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

zzcms SQL Injection Vulnerability (CNVD-2018-06859)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. An attacker can use the 'id' parameter in adv2.php?action=modify request to inject SQL commands and obtain passwords...

ZZCMS user/manage.php file arbitrary file deletion vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the user/manage.php file in ZZCMS version 8.2. The vulnerability can be exploited by a remote attacker to delete arbitrary files with the 'oldimg' or 'oldflv' parameter in an...

ZZCMS 'siteurl' parameter PHP code injection vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited to inject PHP code by sending 'siteurl' parameter to install/index.php file...

ZZCMS 'oldimg' parameter arbitrary file deletion vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited by a remote attacker to delete arbitrary files with the 'oldimg' parameter in an action=modify request with a directory...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8965

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8965

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...