CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8967

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8967

ZZCMS 8.2 is affected by CVE-2018-8967. The vulnerability is a SQL injection via the id parameter in adv2.php?action=modify, allowing attacker-supplied SQL commands. Public details consistently describe impact as potential data compromise (partial confidentiality/integrity/availability) and, per ...

CVE-2018-8966

The CVE-2018-8966 entry affects zzcms version 8.2, where the siteurl parameter of install/index.php can be exploited to inject PHP code. The issue is demonstrated by injecting a phpinfo() call into /inc/config.php, indicating code execution via a parameter. Several connected sources corroborate t...

CVE-2018-8969

CVE-2018-8969 affects zzcms 8.2, specifically the user/licence_save.php endpoint. The vulnerability allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter of an action=modify request, which can be used to progress to database access by deleting...

CVE-2018-8968

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8965

An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8969

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-8965

The CVE-2018-8965 entry affects zzcms v8.2, specifically the user/ppsave.php endpoint. An issue in the oldimg parameter of an action=modify request allows remote attackers to perform directory traversal and delete arbitrary files (notably install.lock), enabling potential database access. Evidenc...

CVE-2018-8968

CVE-2018-8968 affects zzCMS version 8.2, specifically the user/manage.php endpoint. A vulnerability in the handling of directory traversal sequences in the oldimg and oldflv parameters within an action=modify request allows remote attackers to delete arbitrary files (including install.lock), crea...

CVE-2018-8969: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/licencesave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

PT-2018-18745 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue in zzcms allows PHP code injection via the siteurl parameter to the "install/index.php" endpoint, enabling the injection of PHP code, such as a phpinfo call, into "/inc/config.php". Recommendations: For...

CVE-2018-8968: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

PT-2018-18746 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in an "adv2.php?action=modify" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "adv2.php?action=modify" request until the...

CVE-2018-8967: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...

PT-2018-18747 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an "action=modify" request to the "user/manage.php" endpoint...

CVE-2018-8966: Improper Control of Generation of Code

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

PT-2018-18748 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue in zzcms allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request to the "user/licence save.php" endpoint. This can be...