CVE-2020-20285

MEDIUMNuclei

ZZcms - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-20285 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMZZcms - Cross-Site ScriptingCVSS 5.4

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorsedoardottt
Template tagscve2020cvezzcmsxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:zzcms:zzcms:2019:*:*:*:*:*:*:*
FOFA: zzcms
https://github.com/iohex/ZZCMS/blob/master/zzcms2019_login_xss.md https://nvd.nist.gov/vuln/detail/CVE-2020-20285 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2