Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-13056: zzcms 8.3 can delete any file through del.php
CVE-2018-13056 · published 8 years ago
Summary
The file‑deletion function in zzcms version 8.3 lets an attacker remove any file on the server by inserting a path into the system’s database and then triggering an image‑upload request. This could be used to erase important files such as the install.lock file, giving the attacker further access to the database. Update to a patched version of zzcms or restrict access to the /user/del.php page and validate database inputs to stop the exploit.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zzcms | zzcms |
8.3 cpe:2.3:a:zzcms:zzcms:8.3:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. T...
An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock.
References
- https://github.com/actionyz/ZZCMS/blob/master/del.php.md Exploit Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published2 Jul 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-13056 · NVD
Track software like this
Free during beta