CVE-2024-10291
📋 TL;DR
This critical SQL injection vulnerability in ZZCMS 2023 allows remote attackers to execute arbitrary SQL commands through the phome parameter in the Ebak_DoExecSQL/Ebak_DotranExecutSQL functions. Attackers can potentially access, modify, or delete database content. All users running vulnerable versions of ZZCMS 2023 are affected.
💻 Affected Systems
- ZZCMS 2023
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Database information disclosure, data manipulation, or authentication bypass
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
Exploit details are publicly available on GitHub; SQL injection is straightforward to weaponize
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Monitor ZZCMS vendor for official patch 2. Apply patch immediately when available 3. Test in staging environment first
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the phome parameter
Modify 3/Ebak5.1/upload/phome.php to validate/sanitize phome parameter
File Access Restriction
allRestrict access to vulnerable file via web server configuration
Add deny rule for phome.php in .htaccess or web server config
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting phome parameter
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check if file 3/Ebak5.1/upload/phome.php exists and contains Ebak_DoExecSQL/Ebak_DotranExecutSQL functions without proper input validationCheck Version:
Check ZZCMS version in admin panel or configuration filesVerify Fix Applied:
Verify phome parameter is properly validated/sanitized or file is no longer accessible📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to phome.php with SQL patterns
Network Indicators:
- HTTP requests to */3/Ebak5.1/upload/phome.php with SQL injection payloads
SIEM Query:
web.url:*phome.php AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT* OR web.query:*DELETE*)