CVE-2024-7927: Zzcms Path Traversal Vulnerability

CVE-2024-7927 Overview

CVE-2024-7927 is a path traversal vulnerability [CWE-22] affecting ZZCMS 2023. The flaw resides in the /admin/class.php?dowhat=modifyclass endpoint, where the skin[] parameter is not properly sanitized before being used in file system operations. Remote attackers can manipulate this parameter to traverse directories and access files outside the intended path. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed ZZCMS instances.

Critical Impact

Authenticated or improperly access-controlled requests to the admin endpoint allow remote attackers to read or manipulate files outside the web root via the skin[] parameter, leading to information disclosure and potential integrity loss.

Affected Products

• ZZCMS 2023
• Vendor: zzcms
• Component: admin/class.php (dowhat=modifyclass handler)

Discovery Timeline

• 2024-08-19 - CVE-2024-7927 published to NVD
• 2024-09-04 - Last updated in NVD database

Technical Details for CVE-2024-7927

Vulnerability Analysis

The vulnerability is a directory traversal weakness in the administrative interface of ZZCMS 2023. The dowhat=modifyclass action in /admin/class.php accepts a skin[] array parameter that is incorporated into file paths without canonicalization or restriction. By supplying traversal sequences such as ../, an attacker can escape the intended skin directory and reference arbitrary files on the server.

Because the parameter is passed as an array (skin[]), filtering logic that assumes a scalar value may be bypassed entirely. The attack is remotely exploitable over HTTP and requires no user interaction. Successful exploitation can expose configuration files, credentials, and other sensitive server-side content. See the Gitee Directory Traversal Analysis and VulDB #275113 for additional technical context.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The modifyclass handler concatenates user-controlled skin[] values into file paths without validating that the resolved path stays within the intended skin directory. Missing input normalization and lack of allow-list validation enable directory traversal.

Attack Vector

The attack is network-based with low complexity. An attacker sends a crafted HTTP request to /admin/class.php?dowhat=modifyclass with a malicious skin[] value containing path traversal sequences. No verified public proof-of-concept code is available in the enriched data, so technical specifics should be reviewed in the linked third-party analysis rather than reproduced here.

Detection Methods for CVE-2024-7927

Indicators of Compromise

• HTTP requests to /admin/class.php containing dowhat=modifyclass combined with skin[] parameters that include ../, ..%2f, or encoded traversal sequences.
• Web server access logs showing administrative endpoint access from unexpected source IPs or user agents.
• Unexpected file reads or writes outside the ZZCMS skin directory hierarchy.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query parameters for path traversal payloads on the class.php endpoint.
• Enable verbose PHP error logging and alert on file inclusion or fopen/include failures referencing paths outside the application root.
• Correlate administrative endpoint access with authentication events to identify unauthorized admin interactions.

Monitoring Recommendations

• Monitor /admin/ URI requests for anomalous parameter structures, especially array-style parameters such as skin[].
• Track file integrity on the ZZCMS installation directory and adjacent paths to identify unauthorized reads or writes.
• Aggregate web logs into a centralized logging or SIEM platform for retrospective hunting against the traversal pattern.

How to Mitigate CVE-2024-7927

Immediate Actions Required

• Restrict access to the /admin/ directory through network ACLs, VPN, or IP allow-listing until a patch is applied.
• Audit web server logs for prior requests matching the skin[] traversal pattern and investigate any matches.
• Rotate credentials and review configuration files that may have been exposed if exploitation is suspected.

Patch Information

No vendor patch or fixed version is referenced in the enriched data at the time of writing. Operators should monitor the VulDB entry #275113 and the ZZCMS project channels for vendor remediation. Until an official fix is released, apply the workarounds below.

Workarounds

• Implement WAF or reverse-proxy rules that reject requests to class.php containing ../, ..\, or URL-encoded traversal sequences in any parameter.
• Configure the PHP open_basedir directive to constrain file access to the ZZCMS application directory, limiting the impact of traversal attempts.
• Disable or remove the modifyclass admin functionality if it is not required in your deployment.
• Enforce strong authentication and session controls on all /admin/ endpoints to reduce the attack surface.

# Example open_basedir restriction in php.ini or vhost config
php_admin_value open_basedir "/var/www/zzcms/:/tmp/"

# Example nginx rule to block traversal payloads on the vulnerable endpoint
location ~ ^/admin/class\.php$ {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
}