CVE-2024-43006

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-43006
A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information.
CVSS

No CVSS.

References
Link Resource
http://www.zzcms.net/about/download.html Broken Link
https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43006%20ZZCMS2023%E5%82%A8%E5%AD%98%E5%9E%8BXSS.md Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:zzcms:zzcms:2023:*:*:*:*:*:*:*
History

21 Apr 2025, 14:59

Type Values Removed Values Added
References () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43006%20ZZCMS2023%E5%82%A8%E5%AD%98%E5%9E%8BXSS.md - () https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43006%20ZZCMS2023%E5%82%A8%E5%AD%98%E5%9E%8BXSS.md - Broken Link
References () http://www.zzcms.net/about/download.html - () http://www.zzcms.net/about/download.html - Broken Link
First Time Zzcms
Zzcms zzcms
CPE cpe:2.3:a:zzcms:zzcms:2023:*:*:*:*:*:*:*

16 Aug 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-16 20:15

Updated : 2025-04-21 14:59

NVD link : CVE-2024-43006

Mitre link : CVE-2024-43006

JSON object : View

Products Affected

zzcms

  • zzcms
CWE

No CWE.