CVE-2024-44821 Security feature bypass in n/a
Attackers can bypass captcha protection in ZZCMS by reusing failed validation attempts to capture the correct value, enabling automated attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-44821?
CVE-2024-44821 is a medium-severity vulnerability in Zzcms Zzcms, published on 4 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same incorrect captcha response, allowing them to capture the correct captcha value through error messages.
Weakness: CWE-287
Which versions are affected by CVE-2024-44821?
It affects 1 product.
Products include Zzcms Zzcms.
How do I fix CVE-2024-44821?
No fix has been published for CVE-2024-44821 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-44821 being exploited?
There is no known exploitation of CVE-2024-44821 in the wild and no public exploit code.
Other vulnerabilities in Zzcms Zzcms
Sources
Also known as GHSA-6g49-7hrc-9j92.