Sensitive Information Disclosure in ZZCMS by ZZCMS
CVE-2024-44820

6.1MEDIUM

Key Information:

Vendor

Zzcms

Status
Zzcms
Vendor
CVE Published:
4 September 2024

What is CVE-2024-44820?

A vulnerability exists in ZZCMS versions 2023 and earlier, specifically in the eginfo.php file located at /3/E_bak5.1/upload/. When an attacker accesses this file with the query parameter phome=ShowPHPInfo, it triggers the execution of the phpinfo() function. This behavior exposes sensitive information about the PHP environment, including extensive details regarding server configuration, loaded modules, and various environment variables, potentially aiding malicious users in compromising the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024...
ExploitThird Party Advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.