Csz Cms
CVE-2024-25414
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file.
AnalysisAI
An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. Affected products include: Cszcms Csz Cms.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus. Rated critical severity (CVSS 9.
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers. Rated critical severity (CVSS 9.8), this
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser. Rated critical severity (CVSS 9.8), this v
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser. Rated critical severity (CVSS 9.8), this
Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers. Rated critical severity (CVSS 9.8), thi
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP U
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. Rated critical severity (CVSS 9.1), this vulnerability is remote
CSZ CMS 1.1.8 has CSRF via admin/users/new/add. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile fu
A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted scrip
Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute ar
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HT
Share
External POC / Exploit Code
Leaving vuln.today