CVE-2018-9331

CVE-2018-9331 affects zzcms 8.2. The vulnerability is in the user/adv.php endpoint, where the oldimg parameter allows directory traversal to delete arbitrary files. This can be exploited to delete install.lock, potentially enabling access to the database. Public sources in CNVD/Curated CVE entrie...

PT-2018-18988 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in the user/adv.php endpoint. This can be leveraged for database access by...

CVE-2018-9331: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

Sql injection

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

CVE-2018-9309 affects zzcms 8.2, where the id parameter in the dl/dl_sendsms.php request enables SQL injection. The NVD entry documents a high‑risk flaw with CVSS v3.1 base score 9.8 (NETWORK, LOW complexity, no privileges, UI/N user interaction, with HIGH impact on confidentiality, integrity, an...

CVE-2018-9309: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

PT-2018-18966 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...

ZZCMS user/manage.php file arbitrary file deletion vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the user/manage.php file in ZZCMS version 8.2. The vulnerability can be exploited by a remote attacker to delete arbitrary files with the 'oldimg' or 'oldflv' parameter in an...

ZZCMS 'oldimg' parameter arbitrary file deletion vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited by a remote attacker to delete arbitrary files with the 'oldimg' parameter in an action=modify request with a directory...

zzcms SQL Injection Vulnerability (CNVD-2018-06859)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. An attacker can use the 'id' parameter in adv2.php?action=modify request to inject SQL commands and obtain passwords...

ZZCMS 'siteurl' parameter PHP code injection vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited to inject PHP code by sending 'siteurl' parameter to install/index.php file...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

Directory traversal

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8967

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...

CVE-2018-8968

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

Code injection

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...