Cross Site Request Forgery in ZZCMS by ZZCMS
CVE-2023-36162

8.8HIGH

Key Information:

Vendor

Zzcms

Status
Zzcms
Vendor
CVE Published:
3 July 2023

What is CVE-2023-36162?

A Cross Site Request Forgery (CSRF) vulnerability exists in ZZCMS version 2023 and earlier, which could allow an attacker to exploit the add function in adminlist.php. This enables unauthorized privilege escalation, potentially granting the attacker access to sensitive administrative functions. Users of affected versions should take immediate measures to secure their installations against potential exploitation.

References

https://github.com/779789571/zzcms/blob/main/README.md
https://github.com/forget-code/zzcms/issues/6
http://www.zzcms.net/about/download.html

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.