CVE-2025-0565
Published: 19 January 2025
Description
A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Security Summary
CVE-2025-0565 is a SQL injection vulnerability in ZZCMS 2023, rated as critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It affects an unknown functionality in the /index.php file, where manipulation of the 'id' argument enables SQL injection. The vulnerability is linked to CWE-74 (improper neutralization of special elements) and CWE-89 (SQL injection) and was published on 2025-01-19.
Remote attackers without authentication prerequisites can exploit this issue by crafting requests that inject malicious SQL via the 'id' parameter in /index.php. Successful exploitation could result in low impacts to confidentiality (e.g., limited data exposure), integrity (e.g., minor unauthorized modifications), and availability (e.g., slight service disruption), depending on the database privileges and backend configuration.
Advisories from VulDB (ctiid.292526, id.292526, submit.484333) document the vulnerability details, while a GitHub repository (En0t5/vul/blob/main/zzcms/zzcsm-sql-inject.md) provides a publicly disclosed exploit proof-of-concept that may be actively used by attackers.
The public availability of the exploit POC heightens the risk for unpatched ZZCMS 2023 instances exposed to the internet.
Details
- CWE(s)