CVE-2024-10290
📋 TL;DR
This vulnerability in ZZCMS 2023 allows remote attackers to access sensitive information through the file 3/qq-connect2.0/API/com/inc.php. The information disclosure could expose system details, configuration data, or other sensitive content. All users running ZZCMS 2023 are affected.
💻 Affected Systems
- ZZCMS
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive configuration data, database credentials, or system information that could enable further attacks or data breaches.
Likely Case
Attackers access non-critical system information or configuration details that could aid in reconnaissance for additional attacks.
If Mitigated
Information exposure is limited to non-sensitive data or blocked by proper access controls and network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic skills
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or apply workarounds.
🔧 Temporary Workarounds
Restrict access to vulnerable file
allBlock direct access to the vulnerable inc.php file using web server configuration
# Apache: Add to .htaccess
<Files "inc.php">
Order Allow,Deny
Deny from all
</Files>
# Nginx: Add to server block
location ~* /3/qq-connect2.0/API/com/inc\.php$ {
deny all;
return 403;
}
Remove or rename vulnerable file
linuxTemporarily remove or rename the inc.php file to prevent exploitation
mv /path/to/3/qq-connect2.0/API/com/inc.php /path/to/3/qq-connect2.0/API/com/inc.php.bak
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted IPs only
- Deploy a web application firewall (WAF) with rules to block access to the vulnerable path
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[your-domain]/3/qq-connect2.0/API/com/inc.php. If it returns content instead of being blocked or returning an error, the system is vulnerable.Check Version:
Check ZZCMS version in admin panel or configuration filesVerify Fix Applied:
After applying workarounds, attempt to access the vulnerable URL and verify it returns 403 Forbidden or is otherwise inaccessible.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /3/qq-connect2.0/API/com/inc.php
- Unusual access patterns to the qq-connect2.0 directory
Network Indicators:
- HTTP GET requests to the vulnerable inc.php file from external IPs
SIEM Query:
source="web_server_logs" AND (uri="/3/qq-connect2.0/API/com/inc.php" OR uri LIKE "%/inc.php") AND status=200