CVE-2023-45554

CRITICAL

zzzcms 2.1.9 - Unauthenticated Arbitrary File Upload via imageext Parameter Manipulation

Title source: llm

Description

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, and png to jpg, jpeg,gif, png, pphphp.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/96xiaopang/Vulnerabilities/blob/main/zzzcms%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0_en.md

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0152

EPSS Percentile 71.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

zzzcms/zzzcms 2.1.9

Published Oct 25, 2023

Tracked Since Feb 18, 2026