CVE-2024-0603
📋 TL;DR
This is a critical remote code execution vulnerability in ZhiCms CMS software. Attackers can exploit insecure deserialization in the giftcontroller.php file to execute arbitrary code on affected systems. All ZhiCms installations up to version 4.0 are vulnerable if the gift plugin is enabled.
💻 Affected Systems
- ZhiCms
📦 What is this software?
Zhicms by Zhicms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, install malware, steal data, and pivot to other systems.
Likely Case
Remote code execution leading to web shell installation, data theft, and potential lateral movement within the network.
If Mitigated
Attack blocked at perimeter with proper WAF rules and input validation in place.
🎯 Exploit Status
Public exploit code is available, making this easily weaponizable. Attack requires sending crafted data to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Disable Gift Plugin
allRemove or disable the vulnerable gift plugin to prevent exploitation.
rm -rf app/plug/controller/giftcontroller.php
Disable plugin via admin panel if available
Input Validation
allAdd proper input validation and sanitization for the mylike parameter.
Edit app/plug/controller/giftcontroller.php to validate/sanitize input before deserialization
🧯 If You Can't Patch
- Implement WAF rules to block requests containing serialized PHP objects
- Restrict network access to affected systems and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if file app/plug/controller/giftcontroller.php exists and contains unserialize() calls without proper validation.Check Version:
Check ZhiCms version in configuration files or admin panelVerify Fix Applied:
Verify gift plugin is disabled or file is removed, and test with known exploit payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to giftcontroller.php
- PHP unserialize errors in logs
- Unexpected file creations in web directories
Network Indicators:
- HTTP requests containing serialized PHP objects (O:... patterns)
- Traffic to giftcontroller.php with unusual parameters
SIEM Query:
source="web_logs" AND uri="*giftcontroller.php*" AND (method="POST" OR params="*mylike=*")