CVE-2024-10293
📋 TL;DR
This critical vulnerability in ZZCMS 2023 allows remote attackers to upload arbitrary files without restrictions via the Ebak_SetGotoPak function. Attackers can exploit this to upload malicious files like webshells, potentially gaining full control of affected systems. All installations of ZZCMS 2023 with the vulnerable component are affected.
💻 Affected Systems
- ZZCMS
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Webshell installation enabling persistent backdoor access and lateral movement within the network
If Mitigated
File upload attempts blocked or logged with no successful exploitation
🎯 Exploit Status
Public exploit code available on GitHub, making trivial exploitation likely
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or applying manual fixes.
🔧 Temporary Workarounds
Restrict file upload directory permissions
linuxSet upload directory to read-only for web server user
chmod 555 /path/to/upload/directory
chown root:root /path/to/upload/directory
Web Application Firewall rule
allBlock requests to vulnerable endpoint
# Example mod_security rule: SecRule REQUEST_URI "@contains /3/Ebbak5.1/upload/class/functions.php" "id:1001,phase:1,deny"
🧯 If You Can't Patch
- Remove or rename the vulnerable functions.php file: mv /path/to/functions.php /path/to/functions.php.disabled
- Implement strict file upload validation: only allow specific file types and scan all uploads with antivirus
🔍 How to Verify
Check if Vulnerable:
Check if file exists: /3/Ebbak5.1/upload/class/functions.php and contains Ebak_SetGotoPak functionCheck Version:
Check ZZCMS version in admin panel or configuration filesVerify Fix Applied:
Verify functions.php is removed/renamed or file upload restrictions are properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /3/Ebbak5.1/upload/class/functions.php
- POST requests with file parameters to vulnerable endpoint
- Webshell file creation in upload directories
Network Indicators:
- HTTP requests containing 'Ebak_SetGotoPak' parameter
- File uploads with unusual extensions (.php, .jsp, .asp) to CMS
SIEM Query:
source="web_logs" AND (uri="*functions.php*" AND method="POST" AND params="*file*")