zzcms SQL Injection Vulnerability (CNVD-2018-13893)

ZzCMS is the content management system of Webmaster Merchants. A SQL injection vulnerability exists in /user/del.php in zzcms 8.3. An attacker can exploit this vulnerability by using the zzcmsask table and exploiting SQL injection via the tablename parameter...

PT-2018-11612

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue allows SQL injection via the tablename parameter in the /user/del.php endpoint after leveraging use of the zzcms ask table. Recommendations For zzcms version 8.3, avoid using the tablename parameter in t...