CVE-2019-12354
📋 TL;DR
This SQL injection vulnerability in zzcms 2019 allows authenticated administrators to execute arbitrary SQL commands through the /admin/showbad.php endpoint via the id parameter. Attackers with admin privileges can exploit this to manipulate or extract database content. Only zzcms 2019 installations with admin accounts are affected.
💻 Affected Systems
- zzcms
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, or potential remote code execution if database functions allow it.
Likely Case
Unauthorized data access, modification of application data, or extraction of sensitive information from the database.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and restricted admin account access.
🎯 Exploit Status
Exploitation requires admin credentials. SQL injection via id parameter is straightforward for attackers with access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions of zzcms (post-2019)
Vendor Advisory: https://github.com/cby234/zzcms/issues/5
Restart Required: No
Instructions:
1. Upgrade to latest zzcms version. 2. Apply input validation and parameterized queries to /admin/showbad.php. 3. Review and secure admin authentication mechanisms.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize id parameter before processing
Modify showbad.php to validate id parameter as integer: if(!is_numeric($_GET['id'])) { die('Invalid input'); }
Access Restriction
linuxRestrict access to /admin/showbad.php to specific IP addresses
Add to .htaccess: Order Deny,Allow\nDeny from all\nAllow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Disable or remove the /admin/showbad.php endpoint if not required
🔍 How to Verify
Check if Vulnerable:
Test /admin/showbad.php?id=1' OR '1'='1 with admin credentials to see if SQL error occursCheck Version:
Check zzcms version in admin panel or readme filesVerify Fix Applied:
Test same payload after fix - should return error message or no SQL errors📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Multiple requests to /admin/showbad.php with unusual id parameters
Network Indicators:
- SQL injection patterns in HTTP requests to admin endpoints
SIEM Query:
source="web_logs" AND uri="/admin/showbad.php" AND (query="*'*" OR query="*OR*" OR query="*UNION*" OR query="*SELECT*" OR query="*FROM*")