CVE-2024-10293 ZZCMS functions.php Ebak_SetGotoPak unrestricted upload
Remote attackers can upload malicious files via the Ebak_SetGotoPak function in ZZCMS, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10293?
CVE-2024-10293 is a medium-severity vulnerability in Zzcms Zzcms, published on 23 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/functions.php. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Weakness: CWE-434
Which versions are affected by CVE-2024-10293?
It affects 1 product.
Products include Zzcms Zzcms.
How do I fix CVE-2024-10293?
No fix has been published for CVE-2024-10293 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-10293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10293 exists.
Other vulnerabilities in Zzcms Zzcms
Sources
Also known as GHSA-rw27-7fmj-vgcv.