Sensitive Information Disclosure in ZZCMS by ZZCMS
CVE-2024-44820

6.1MEDIUM

Key Information:

Vendor
Zzcms
Status
Zzcms
Vendor
CVE Published:
4 September 2024

Summary

A vulnerability exists in ZZCMS versions 2023 and earlier, specifically in the eginfo.php file located at /3/E_bak5.1/upload/. When an attacker accesses this file with the query parameter phome=ShowPHPInfo, it triggers the execution of the phpinfo() function. This behavior exposes sensitive information about the PHP environment, including extensive details regarding server configuration, loaded modules, and various environment variables, potentially aiding malicious users in compromising the application.

References

https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024...
ExploitThird Party Advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.