CVE-2020-21052

Name of the Vulnerable Software and Affected Versions zrlog version 2.1.3

Description The issue allows a remote attacker to execute arbitrary code via the nickame parameter of the "/post/addComment" API endpoint. This enables the attacker to perform actions such as injecting malicious scripts.

Recommendations For zrlog version 2.1.3, consider disabling the /post/addComment function until a patch is available to prevent exploitation via the nickame parameter. Restrict access to this function to minimize the risk of arbitrary code execution.