Lucene search

MitreCVE-2018-8966

HistoryMar 24, 2018 - 6:29 p.m.

CVE-2018-8966

2018-03-2418:29:00

CWE-94

mitre

web.nvd.nist.gov

zzcms

php

code injection

security vulnerability

siteurl parameter

cve-2018-8966

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.006

Percentile

78.8%

JSON

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.

Affected configurations

Nvd

Node

zzcmszzcmsMatch8.2

VendorProductVersionCPE
zzcmszzcms8.2cpe:2.3:a:zzcms:zzcms:8.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zzcms	zzcms	8.2	cpe:2.3:a:zzcms:zzcms:8.2:::::::*

References

github.com/Ni9htMar3/vulnerability/blob/master/zzcms_8.2/install.md

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.006

Percentile

78.8%

JSON

Related for CVE-2018-8966