CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8965

The CVE-2018-8965 entry affects zzcms v8.2, specifically the user/ppsave.php endpoint. An issue in the oldimg parameter of an action=modify request allows remote attackers to perform directory traversal and delete arbitrary files (notably install.lock), enabling potential database access. Evidenc...

CVE-2018-8966

The CVE-2018-8966 entry affects zzcms version 8.2, where the siteurl parameter of install/index.php can be exploited to inject PHP code. The issue is demonstrated by injecting a phpinfo() call into /inc/config.php, indicating code execution via a parameter. Several connected sources corroborate t...

CVE-2018-8969

CVE-2018-8969 affects zzcms 8.2, specifically the user/licence_save.php endpoint. The vulnerability allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter of an action=modify request, which can be used to progress to database access by deleting...

PT-2018-18746 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in an "adv2.php?action=modify" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "adv2.php?action=modify" request until the...

PT-2018-18748 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request to the "user/licence save.php" endpoint. This can be...

PT-2018-18745 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue in zzcms allows PHP code injection via the siteurl parameter to the "install/index.php" endpoint, enabling the injection of PHP code, such as a phpinfo call, into "/inc/config.php". Recommendations: For...

CVE-2018-8965: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8967: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...

CVE-2018-8966: Improper Control of Generation of Code

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8969: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8968: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

PT-2018-18747 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an "action=modify" request to the "user/manage.php" endpoint...

Arbitrary File Deletion Vulnerability in ZZCMS

Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. ZZCMS has an arbitrary file deletion vulnerability...

SQL Injection Vulnerability in ZZCMS /admin/logincheck.php File

Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. ZZCMS /admin/logincheck.php file SQL injection...

Arbitrary User Password Reset and Reflective Cross-site Scripting Vulnerabilities in zzcms System

Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. zzcms system exists arbitrary user password reset and...

Stored Cross-Site Scripting Vulnerability in ZZCMS Version 8.2

zzcms is a free website builder developed in asp language. A stored cross-site scripting vulnerability exists in the show.php file of zzcms version 8.2, which allows an attacker to insert malicious code into the page to obtain information such as user cookies...

Configuration file write vulnerability in ZZCMS version 8.2

zzcms is a free website builder developed in asp language. There is a configuration file writing vulnerability in the index.php file of zzcms version 8.2, which can be exploited by an attacker to write some configuration information into the configuration file to gain server privileges...

Arbitrary File Deletion Vulnerability in ZZCMS Version 8.2

zzcms is a free website builder developed in asp language. ZZCMS 8.2 version of the usermsg.php file in the arbitrary file deletion vulnerability, an attacker can use the vulnerability to delete arbitrary files...

Reflected Cross-Site Scripting Vulnerability in ZZCMS Version 8.2

zzcms is a free website builder developed in asp language. A reflective cross-site scripting vulnerability exists in the step6.php file in version 8.2 of zzcms, which allows an attacker to construct an XSS statement, perform a pop-up box operation, and obtain information such as a user's cookie...