CVE-2019-16720

CVE-2019-16720 affects ZZZCMS zzzphp v1.7.2, where the upload restriction in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage is insufficient, allowing uploading a .htaccess or .php5 file. The Red Hat and NVD entries confirm the same description. No exploit details, affected ver...

CVE-2019-16720

ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...

ZZZCMS zzzphp input validation error vulnerability

ZZZCMS zzzphp is a content management system CMS. An input validation error vulnerability exists in ZZZCMS zzzphp v1.7.2, which can be exploited by an attacker to execute arbitrary code...

CVE-2019-16720: Unrestricted Upload of File with Dangerous Type

ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...

CVE-2019-16722: Undefined Security Weakness

ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...

PT-2019-14794

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.7.2 Description The issue is related to an insufficient protection mechanism against PHP code execution. Specifically, the passthru function bypasses an str ireplace operation, which is intended to prevent certain types...

PT-2019-14792

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.7.2 Description The issue concerns a lack of proper restriction on file uploads in the plugins/ueditor/php/controller.php endpoint, specifically when the "upfolder" parameter is set to "news" and the "action" parameter ...

SQL Injection Vulnerability in ZZZCMS Backend

zzcms is an asp language development of the site building system. There is a SQL injection vulnerability in the backend of ZZZCMS, which can be exploited by attackers to obtain sensitive database information...

ZZZCMS V1.7.1 version exists arbitrary file reading vulnerability

ZZZCMS enterprise station system using PHP + MYSQL language development, is a set of mature and perfect enterprise station CMS system, the cover is fully functional, customization of powerful, scalable, high security, can easily solve most of the enterprise station needs. ZZZCMS V1.7.1 version of...

File Upload Vulnerability in ZZZCMS V1.7.2

zzcms is a free and open source building system, mainly facing the majority of webmasters to use. A file upload vulnerability exists in ZZZCMS V1.7.2. An attacker can exploit the vulnerability to obtain server privileges...

ZZZCMS V1.7.2 version of the background of the existence of arbitrary file reading vulnerability

zzcms is a free and open source building system, mainly facing the majority of webmasters to use. ZZZCMS V1.7.2 there are arbitrary file reading vulnerabilities in the background. An attacker can exploit the vulnerability to read arbitrary files and conduct intranet probes...

SQL injection vulnerability in ad***/sa***.php file of zzzcms V1.7.1 version

zzcms is an asp language development of the site building system. zzzcms V1.7.1 version ad/sa.php file SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

File upload vulnerability in zzzcms V1.7.1 version

zzcms is an asp language development of the site building system. A file upload vulnerability exists in zzzcms V1.7.1, which can be exploited by attackers to gain control of the web server...

ZZZCMS zzzphp code injection vulnerability

ZZZCMS zzzphp is a content management system CMS. A code injection vulnerability exists in ZZZCMS zzzphp v1.6.3, which originates from a network system or product that does not properly filter specific elements of externally entered data during the construction of a code segment. An attacker can...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

Code injection

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 is vulnerable to remote code execution (RCE) due to a lack of restrictions in inc/zzz_file.php . Attackers can execute arbitrary PHP code by providing a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter. Exploitation requires the attac...

CVE-2019-10647: Unrestricted Upload of File with Dangerous Type

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...