Zzzcms

Zzzphp

14 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2019-9182

Exploit
  • EPSS 0.15%
  • Published 26.02.2019 07:29:00
  • Last modified 21.11.2024 04:51:09

There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter.

9.3

CVE-2019-9082

Warning Exploit
  • EPSS 94.14%
  • Published 24.02.2019 18:29:00
  • Last modified 14.03.2025 17:49:18

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

7.2

CVE-2019-9041

Exploit
  • EPSS 85.67%
  • Published 23.02.2019 18:29:00
  • Last modified 21.11.2024 04:50:52

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.

7.5

CVE-2018-20127

Exploit
  • EPSS 0.77%
  • Published 13.12.2018 08:29:00
  • Last modified 21.11.2024 04:00:54

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.