CVE-2024-43009

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43009
A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://www.zzcms.net/about/download.html Broken Link
https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*
History

21 Apr 2025, 14:59

Type Values Removed Values Added
CPE cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*
References () http://www.zzcms.net/about/download.html - () http://www.zzcms.net/about/download.html - Broken Link
References () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md - () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md - Broken Link
First Time Zzcms
Zzcms zzcms

19 Aug 2024, 14:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CWE CWE-79

19 Aug 2024, 13:00

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en user/login.php en la línea 24 en ZZCMS 2023 y versiones anteriores. La aplicación inserta directamente el valor del encabezado HTTP_REFERER en la respuesta HTML sin una desinfección adecuada. Un atacante puede aprovechar esta vulnerabilidad engañando a un usuario para que visite una URL especialmente manipulada, que incluye un encabezado Referer malicioso. Esto puede llevar a la ejecución de código JavaScript arbitrario en el contexto del navegador de la víctima, lo que podría resultar en secuestro de sesión, alteración u otras actividades maliciosas.

16 Aug 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-16 20:15

Updated : 2025-04-21 14:59

NVD link : CVE-2024-43009

Mitre link : CVE-2024-43009

CVE.ORG link : CVE-2024-43009

JSON object : View

Products Affected

zzcms

  • zzcms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')