Path Traversal Vulnerability in ZZCMS 2023
CVE-2024-7926
Key Information:
Badges
What is CVE-2024-7926?
A critical path traversal vulnerability has been identified in the ZZCMS 2023 version. This security flaw affects the /admin/about_edit.php file, where an unauthenticated user can manipulate the 'skin' parameter. This manipulation enables attackers to traverse the server's directory structure, potentially gaining access to sensitive files and information. The exploit is accessible remotely, making it imperative for users to take immediate action to protect their installations. It is crucial to apply the latest security patches provided by the vendor to mitigate the risks associated with this vulnerability. Public disclosure of the exploit increases the urgency for remediation to prevent potential data breaches.
Affected Version(s)
ZZCMS 2023
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.