CVE-2024-2016

A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability.

CVSS v3.0 8.8 HIGH

8.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5	Exploit
https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5	Exploit
https://vuldb.com/?ctiid.255270	Permissions Required VDB Entry
https://vuldb.com/?ctiid.255270	Permissions Required VDB Entry
https://vuldb.com/?id.255270	Third Party Advisory VDB Entry
https://vuldb.com/?id.255270	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:zhicms:zhicms:4.0:*:*:*:*:*:*:*

History

19 May 2025, 13:09

Type	Values Removed	Values Added
References	~~() https://vuldb.com/?ctiid.255270 -~~	() https://vuldb.com/?ctiid.255270 - Permissions Required, VDB Entry
References	~~() https://vuldb.com/?id.255270 -~~	() https://vuldb.com/?id.255270 - Third Party Advisory, VDB Entry
References	~~() https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 -~~	() https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 - Exploit
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
First Time		Zhicms Zhicms zhicms
CPE		cpe:2.3:a:zhicms:zhicms:4.0:::::::*

21 Mar 2024, 02:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-21 02:52

Updated : 2025-05-19 13:09

NVD link : CVE-2024-2016

Mitre link : CVE-2024-2016

JSON object : View

Products Affected

zhicms

zhicms

CWE

No CWE.

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5", "name": "https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5", "tags": ["Exploit"], "refsource": ""}, {"url": "https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5", "name": "https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5", "tags": ["Exploit"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.255270", "name": "VDB-255270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.255270", "name": "VDB-255270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?id.255270", "name": "VDB-255270 | ZhiCms setcontroller.php index code injection", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?id.255270", "name": "VDB-255270 | ZhiCms setcontroller.php index code injection", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-2016", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}}, "publishedDate": "2024-03-21T02:52Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:zhicms:zhicms:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-05-19T13:09Z"}