ZZCMS list.php path traversal
CVE-2024-7924
Key Information:
Badges
What is CVE-2024-7924?
ZZCMS 2023 has a vulnerability that affects the processing of input in the /I/list.php file, specifically allowing path traversal. This weakness stems from improper validation of the 'skin' argument, potentially enabling remote attackers to access sensitive files on the server. The vulnerability has been publicly disclosed, which raises concerns over its exploitation by malicious actors who may perform unauthorized read operations on the filesystem. Organizations using the affected version of ZZCMS should consider immediate remediation steps to secure their databases and sensitive information against potential exploitation.
Affected Version(s)
ZZCMS 2023
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.