CVE-2024-7925
ZZCMS eginfo.php information disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 19, 2024
- Updated
- Sep 3, 2024
- Reserved
- Aug 19, 2024
Description
A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N | VulDB |
Weaknesses
- CWE-200 Information Disclosure
Affected Products
| Product | Versions |
|---|---|
ZZCMSn/a |
|
References
- VDB-275111 | ZZCMS eginfo.php information disclosurevdb-entrytechnical-description
- VDB-275111 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #392121 | ZZCMS China Merchants Network Content Management System zzcms 2023 Exposure of Sensitive Information Through Data Queriesthird-party-advisory
- https://gitee.com/A0kooo/cve_article/blob/master/zzcms/information_leak/Zenmus%20ekinfo.php%20had%20an%20information%20leak.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.