CVE-2019-12351
📋 TL;DR
This SQL injection vulnerability in zzcms 2019 allows attackers to execute arbitrary SQL commands via the id parameter in dl/dl_print.php. Any system running the vulnerable version of zzcms is affected, potentially leading to data theft, modification, or deletion.
💻 Affected Systems
- zzcms
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification of database content, and potential authentication bypass.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Simple SQL injection via URL parameter, no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions of zzcms (post-2019)
Vendor Advisory: https://github.com/cby234/zzcms/issues/3
Restart Required: No
Instructions:
1. Update to latest zzcms version. 2. Replace vulnerable dl/dl_print.php with patched version. 3. Implement parameterized queries for all database interactions.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject id parameters containing commas or non-numeric characters
Add to dl/dl_print.php: if (!is_numeric($_GET['id']) || strpos($_GET['id'], ',') !== false) { die('Invalid input'); }
Web Application Firewall Rule
allBlock requests containing SQL injection patterns in the id parameter
WAF rule: Block if URI contains 'dl_print.php' AND id parameter contains comma or SQL keywords
🧯 If You Can't Patch
- Restrict access to dl/dl_print.php via network controls or authentication
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test by accessing /dl/dl_print.php?id=1, and /dl/dl_print.php?id=1, (with trailing comma) - check for different responsesCheck Version:
Check zzcms version in admin panel or readme filesVerify Fix Applied:
Verify that trailing comma in id parameter returns error or same response as without comma📡 Detection & Monitoring
Log Indicators:
- Multiple requests to dl/dl_print.php with unusual id parameters
- Database error logs showing SQL syntax errors
Network Indicators:
- HTTP requests with SQL keywords in id parameter
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri="*dl_print.php*" AND (query="*id=*%2C*" OR query="*id=*%27*" OR query="*id=*%22*")