An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-09-30T20:00:00

Updated: 2024-08-05T10:54:10.703Z

Reserved: 2018-09-30T00:00:00

Link: CVE-2018-17797

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-09-30T20:29:00.617

Modified: 2024-11-21T03:54:59.950

Link: CVE-2018-17797

cve-icon Redhat

No data.