CVE-2024-43009

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

A

reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities.

References

Link	Resource
http://www.zzcms.net/about/download.html	Broken Link
https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*

History

21 Apr 2025, 14:59

Type	Values Removed	Values Added
First Time		Zzcms zzcms Zzcms
CPE		cpe:2.3:a:zzcms:zzcms::::::::
References	~~() http://www.zzcms.net/about/download.html -~~	() http://www.zzcms.net/about/download.html - Broken Link
References	~~() https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md -~~	() https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md - Broken Link

19 Aug 2024, 14:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-16 20:15

Updated : 2025-04-21 14:59

NVD link : CVE-2024-43009

Mitre link : CVE-2024-43009

CVE.ORG link : CVE-2024-43009

JSON object : View

Products Affected

zzcms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43009", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-08-16T20:15:13.410", "references": [{"url": "http://www.zzcms.net/about/download.html", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md", "tags": ["Broken Link"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en user/login.php en la l\u00ednea 24 en ZZCMS 2023 y versiones anteriores. La aplicaci\u00f3n inserta directamente el valor del encabezado HTTP_REFERER en la respuesta HTML sin una desinfecci\u00f3n adecuada. Un atacante puede aprovechar esta vulnerabilidad enga\u00f1ando a un usuario para que visite una URL especialmente manipulada, que incluye un encabezado Referer malicioso. Esto puede llevar a la ejecuci\u00f3n de c\u00f3digo JavaScript arbitrario en el contexto del navegador de la v\u00edctima, lo que podr\u00eda resultar en secuestro de sesi\u00f3n, alteraci\u00f3n u otras actividades maliciosas."}], "lastModified": "2025-04-21T14:59:06.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zzcms:zzcms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FD00C13-599B-4944-99F6-83C9F44DB42F", "versionEndIncluding": "2023"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}