Vulnerability · Published Jan 16, 2024 · Assigned by VulDB

CVE-2024-0603ZhiCms giftcontroller.php deserialization

High 7.3

In plain English

A high-severity unsafe deserialization in ZhiCms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250839.

Affected products (as reported)

Vendor	Product	Versions
n/a	ZhiCms	4.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.250839 vdb-entry, technical-description
https://vuldb.com/?ctiid.250839 signature, permissions-required
https://note.zhaoj.in/share/n3QsNbORUR0e broken-link, exploit