CVE-2024-10293: Zzcms RCE Vulnerability via File Upload

CVE-2024-10293 Overview

CVE-2024-10293 is an unrestricted file upload vulnerability in ZZCMS 2023, a Chinese content management system. The flaw resides in the Ebak_SetGotoPak function within 3/Ebbak5.1/upload/class/functions.php. Improper handling of the file argument allows remote attackers to upload arbitrary files to the server. The vulnerability has been publicly disclosed and is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Exploitation requires low-privilege authentication but no user interaction. Attackers can leverage this weakness to plant web shells or other malicious content on affected ZZCMS deployments.

Critical Impact

Authenticated remote attackers can upload arbitrary files to ZZCMS 2023 installations, enabling potential web shell deployment and follow-on code execution.

Affected Products

• ZZCMS 2023
• File: 3/Ebbak5.1/upload/class/functions.php
• Function: Ebak_SetGotoPak

Discovery Timeline

• 2024-10-23 - CVE-2024-10293 published to NVD
• 2024-10-30 - Last updated in NVD database

Technical Details for CVE-2024-10293

Vulnerability Analysis

The vulnerability stems from missing validation in the Ebak_SetGotoPak function inside 3/Ebbak5.1/upload/class/functions.php. The function accepts a file parameter and processes it without enforcing restrictions on file type, extension, or destination path. An attacker with authenticated access can supply a crafted file argument to write attacker-controlled content into a server-accessible location. Because ZZCMS is a PHP application, uploaded files with executable extensions can be reached over HTTP and trigger code execution within the web server context. The flaw maps to [CWE-434], which covers cases where applications permit attackers to upload files that the application later treats as code or trusted content.

Root Cause

The root cause is missing or insufficient validation of the file parameter before write operations. The Ebak_SetGotoPak routine does not enforce an allowlist of file extensions, does not sanitize the destination path, and does not restrict MIME types. Combined with PHP execution in the upload directory, this turns a file write primitive into an arbitrary code execution vector.

Attack Vector

The attack is performed over the network against the ZZCMS web interface. The attacker authenticates with low-privilege credentials, then issues a crafted HTTP request that invokes Ebak_SetGotoPak with a malicious file argument. No user interaction is required, and proof-of-concept details have been disclosed publicly through the GitHub Issue Discussion and VulDB entry #281562. The vulnerability mechanism is documented in the public references; refer to those advisories for request structure and parameter details.

Detection Methods for CVE-2024-10293

Indicators of Compromise

• Unexpected .php, .phtml, or other executable files appearing under the 3/Ebbak5.1/upload/ directory tree.
• HTTP POST requests to ZZCMS endpoints invoking backup or Ebak-prefixed functionality with attacker-controlled file parameters.
• New or modified files in web-accessible directories with timestamps that do not correspond to administrative activity.

Detection Strategies

• Monitor web server access logs for requests targeting paths under class/functions.php or backup routines with anomalous parameters.
• Hash and baseline files within the ZZCMS installation directory and alert on additions or modifications outside change windows.
• Inspect outbound connections originating from the PHP-FPM or web server process for indicators of post-upload web shell activity.

Monitoring Recommendations

• Enable verbose logging on the ZZCMS application and forward logs to a central SIEM for correlation.
• Deploy file integrity monitoring on the web root, with particular focus on upload directories.
• Alert on PHP processes spawning shell interpreters such as sh, bash, or cmd.exe, which often follow successful web shell upload.

How to Mitigate CVE-2024-10293

Immediate Actions Required

• Restrict access to the ZZCMS administrative interface using network ACLs or VPN until a vendor patch is available.
• Remove or disable the Ebak_SetGotoPak function and the associated backup module if it is not required for operations.
• Audit the 3/Ebbak5.1/upload/ directory for unauthorized files and remove any artifacts not associated with legitimate activity.
• Rotate credentials for any accounts that had access to the affected ZZCMS instance.

Patch Information

At the time of publication, no official vendor advisory or patch is listed in NVD for CVE-2024-10293. Review the GitHub Issue Discussion for project maintainer updates and apply any fixes published by the ZZCMS project. Track VulDB CTI #281562 for additional remediation details as they become available.

Workarounds

• Configure the web server to deny execution of PHP files within upload directories using rules such as php_admin_flag engine off in Apache or a location block in Nginx.
• Enforce an allowlist of permitted file extensions at the reverse proxy or WAF layer for any endpoint that handles file parameters.
• Require strong authentication and disable default or shared accounts on the ZZCMS application.

# Apache configuration example to block PHP execution in upload paths
<Directory "/var/www/zzcms/3/Ebbak5.1/upload">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>