CVE-2024-10293
MEDIUMZZCMS 2023 - Unrestricted File Upload via Ebak_SetGotoPak Function
Title source: llmDescription
A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/functions.php. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References (4)
Core 4
Core References
Third Party Advisory vdb-entry
technical-description
https://vuldb.com/?id.281562
Permissions Required signature
permissions-required
https://vuldb.com/?ctiid.281562
Third Party Advisory third-party-advisory
https://vuldb.com/?submit.427146
Broken Link exploit
issue-tracking
https://github.com/LvZCh/zzcms2023/issues/6
Scores
CVSS v3
6.3
EPSS
0.0050
EPSS Percentile
39.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-434
Status
published
Products (1)
zzcms/zzcms
2023
Published
Oct 23, 2024
Tracked Since
Feb 18, 2026