Description
The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.
References (1)
Core 1
Core References
Broken Link, Third Party Advisory x_refsource_misc
https://xz.aliyun.com/t/2277
Scores
CVSS v3
7.2
EPSS
0.0065
EPSS Percentile
70.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (1)
zblogcn/z-blogphp
1.5.1
Published
Apr 16, 2018
Tracked Since
Feb 18, 2026