CVE-2019-12356
📋 TL;DR
This SQL injection vulnerability in zzcms 2019 allows authenticated attackers with download authority to execute arbitrary SQL commands through the id parameter in /user/dls_download.php. This affects all zzcms 2019 installations where users have dls_download privileges. Attackers could potentially access, modify, or delete database content.
💻 Affected Systems
- zzcms
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation to admin, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, user information theft, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL execution.
🎯 Exploit Status
SQL injection via GET parameter is trivial to exploit with tools like sqlmap. Requires authenticated user with download privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check latest zzcms releases
Vendor Advisory: https://github.com/cby234/zzcms/issues/5
Restart Required: No
Instructions:
1. Update to latest zzcms version. 2. Apply input validation and parameterized queries to /user/dls_download.php. 3. Review and restrict dls_download authority assignments.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns in the id parameter.
# Example ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403"
Access Restriction
linuxTemporarily restrict access to /user/dls_download.php or remove dls_download authority from non-essential users.
# Apache: <Location /user/dls_download.php> Require ip 192.168.1.0/24 </Location>
# Nginx: location /user/dls_download.php { allow 192.168.1.0/24; deny all; }
🧯 If You Can't Patch
- Implement strict input validation in application code to sanitize the id parameter
- Deploy database-level protections: use least privilege database accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test with sqlmap: sqlmap -u 'http://target/user/dls_download.php?id=1' --cookie='session_cookie' --dbsCheck Version:
Check zzcms version in admin panel or read version files in installation directoryVerify Fix Applied:
Attempt SQL injection tests with malicious id parameters and verify they're rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed download attempts with malformed id parameters
- Database queries from unexpected user accounts
Network Indicators:
- HTTP requests to /user/dls_download.php with SQL injection patterns in id parameter
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/user/dls_download.php" AND (id="*' OR*" OR id="*;--*" OR id="*UNION*" OR id="*SELECT*" OR id="*INSERT*")