A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability.
References
| Link | Resource |
|---|---|
| https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 | Exploit |
| https://vuldb.com/?ctiid.255270 | Permissions Required VDB Entry |
| https://vuldb.com/?id.255270 | Third Party Advisory VDB Entry |
| https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 | Exploit |
| https://vuldb.com/?ctiid.255270 | Permissions Required VDB Entry |
| https://vuldb.com/?id.255270 | Third Party Advisory VDB Entry |
Configurations
History
19 May 2025, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:zhicms:zhicms:4.0:*:*:*:*:*:*:* | |
| First Time |
Zhicms zhicms
Zhicms |
|
| References | () https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 - Exploit | |
| References | () https://vuldb.com/?ctiid.255270 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.255270 - Third Party Advisory, VDB Entry |
21 Nov 2024, 09:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 - | |
| References | () https://vuldb.com/?ctiid.255270 - | |
| References | () https://vuldb.com/?id.255270 - |
21 Mar 2024, 02:52
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-21 02:52
Updated : 2025-05-19 13:09
NVD link : CVE-2024-2016
Mitre link : CVE-2024-2016
CVE.ORG link : CVE-2024-2016
JSON object : View
Products Affected
zhicms
- zhicms
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')