Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-13116: zzcms 8.3 lets attackers execute database queries
CVE-2018-13116 · published 8 years ago
Summary
The file /user/del.php in zzcms version 8.3 accepts a table name from the web request and does not check it properly. This lets an attacker send specially crafted data that can run unwanted commands on the database, potentially exposing or changing your information. Upgrade to a newer zzcms release or apply a fix that validates and sanitizes the input before it is used.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zzcms | zzcms |
8.3. cpe:2.3:a:zzcms:zzcms:8.3.:*:*:*:*:*:*:* |
Original advisory text
/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
References
- https://github.com/actionyz/ZZCMS/blob/master/SQL/1/del.php.md Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published3 Jul 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-13116 · NVD
Track software like this
Free during beta