CVE-2019-12352
📋 TL;DR
This SQL injection vulnerability in zzcms 2019 allows attackers with dls_print authority to execute arbitrary SQL commands via the dlid cookie in /dl/dl_sendmail.php. This can lead to data theft, modification, or deletion. All zzcms 2019 installations using the affected component are vulnerable.
💻 Affected Systems
- zzcms
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, or remote code execution via database functions.
Likely Case
Unauthorized access to sensitive data in the database, including user credentials and private information.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploitation requires dls_print authority but SQL injection via cookie manipulation is well-understood and easily automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for the dlid cookie parameter in /dl/dl_sendmail.php
Edit /dl/dl_sendmail.php to add input validation: $dlid = intval($_COOKIE['dlid']);
Parameterized Queries
allReplace direct SQL string concatenation with prepared statements
Replace: $sql = "SELECT * FROM table WHERE id='" . $_COOKIE['dlid'] . "'"; with prepared statements using mysqli or PDO
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns in cookies
- Restrict access to /dl/dl_sendmail.php to only necessary users and monitor access logs
🔍 How to Verify
Check if Vulnerable:
Check if /dl/dl_sendmail.php exists and processes dlid cookie without proper input validation. Test with SQL injection payloads in dlid cookie.Check Version:
Check zzcms version in admin panel or configuration filesVerify Fix Applied:
Verify that dlid parameter is properly validated (converted to integer) and SQL queries use parameterized statements.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts followed by dl_sendmail.php access
- SQL keywords in cookie values in access logs
Network Indicators:
- SQL injection patterns in HTTP requests to /dl/dl_sendmail.php
- Unusual database queries from web server
SIEM Query:
source="web_logs" AND uri="/dl/dl_sendmail.php" AND (cookie="*dlid*SELECT*" OR cookie="*dlid*UNION*" OR cookie="*dlid*OR*1=1*")