CVE-2024-44821

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44821
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same incorrect captcha response, allowing them to capture the correct captcha value through error messages.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-44821%20ZZCMS2023%20%E9%AA%8C%E8%AF%81%E7%A0%81%E5%A4%8D%E7%94%A8%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E.md Broken Link Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*
History

23 Apr 2025, 15:01

Type Values Removed Values Added
First Time Zzcms
Zzcms zzcms
References () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-44821%20ZZCMS2023%20%E9%AA%8C%E8%AF%81%E7%A0%81%E5%A4%8D%E7%94%A8%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E.md - () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-44821%20ZZCMS2023%20%E9%AA%8C%E8%AF%81%E7%A0%81%E5%A4%8D%E7%94%A8%E9%80%BB%E8%BE%91%E6%BC%8F%E6%B4%9E.md - Broken Link, Exploit, Third Party Advisory
CPE cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*

05 Sep 2024, 12:53

Type Values Removed Values Added
Summary
  • (es) ZZCMS 2023 contiene una vulnerabilidad en la lógica de reutilización de captcha ubicada en /inc/function.php. La función checkyzm no actualiza correctamente el valor del captcha después de un intento de validación fallido. Como resultado, un atacante puede aprovechar esta falla enviando repetidamente la misma respuesta de captcha incorrecta, lo que le permite capturar el valor de captcha correcto a través de mensajes de error.

04 Sep 2024, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-287

04 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-04 16:15

Updated : 2025-04-23 15:01

NVD link : CVE-2024-44821

Mitre link : CVE-2024-44821

CVE.ORG link : CVE-2024-44821

JSON object : View

Products Affected

zzcms

  • zzcms
CWE
CWE-287

Improper Authentication