CVE-2024-7925
📋 TL;DR
This vulnerability in ZZCMS 2023 allows remote attackers to disclose sensitive information by manipulating the 'phome' parameter in the 'eginfo.php' file. The information leak could expose system details, PHP configuration, or other sensitive data. All users running ZZCMS 2023 with the vulnerable file accessible are affected.
💻 Affected Systems
- ZZCMS
📦 What is this software?
Zzcms by Zzcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive system information, PHP configuration details, database credentials, or other secrets that could facilitate further attacks.
Likely Case
Information disclosure revealing PHP version, system paths, configuration settings, and potentially other details about the server environment.
If Mitigated
Limited information exposure with no critical credentials or secrets revealed, but still potentially useful for reconnaissance.
🎯 Exploit Status
Exploit requires simple HTTP request manipulation with the 'phome=ShowPHPInfo' parameter. Public disclosure suggests active exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Remove or restrict access to the vulnerable file '3/E_bak5.1/upload/eginfo.php'.
🔧 Temporary Workarounds
Remove vulnerable file
linuxDelete or rename the vulnerable eginfo.php file to prevent exploitation
rm /path/to/zzcms/3/E_bak5.1/upload/eginfo.php
Restrict file access
allUse web server configuration to block access to the vulnerable file
<LocationMatch "\/3\/E_bak5\.1\/upload\/eginfo\.php">\n Deny from all\n</LocationMatch>
🧯 If You Can't Patch
- Implement WAF rules to block requests containing 'phome=ShowPHPInfo' parameter
- Restrict network access to the ZZCMS installation using firewall rules
🔍 How to Verify
Check if Vulnerable:
Access http://your-site.com/3/E_bak5.1/upload/eginfo.php?phome=ShowPHPInfo and check if PHP information is displayedCheck Version:
Check ZZCMS version in admin panel or configuration filesVerify Fix Applied:
Attempt the same request and verify that PHP information is no longer displayed or the file returns 404/403📡 Detection & Monitoring
Log Indicators:
- HTTP requests to '/3/E_bak5.1/upload/eginfo.php' with 'phome=ShowPHPInfo' parameter
- Unusual information disclosure in access logs
Network Indicators:
- HTTP GET requests with parameter 'phome=ShowPHPInfo' to the vulnerable endpoint
SIEM Query:
source="web_access_logs" AND uri_path="/3/E_bak5.1/upload/eginfo.php" AND query_string="*phome=ShowPHPInfo*"