Cby234

An issue was discovered in zzcms, where there is a SQL injection vulnerability in the "/admin/ztliuyan sendmail.php" endpoint when the attacker has admin authority, via the `id` parameter.

An issue was discovered in zzcms, where there is a SQL injection vulnerability in the /admin/showbad.php endpoint when the attacker has admin authority, via the `id` parameter.

An issue was discovered in the software, which allows for SQL injection via the `id` parameter in the "/user/dls print.php" API endpoint when the attacker has dls print authority.

An issue was discovered in the software, which is a SQL injection vulnerability. This vulnerability exists in the /user/dls download.php endpoint when the attacker has dls download authority, and it can be exploited via the `id` parameter.

An issue was discovered in zzcms, where there is a SQL injection vulnerability in the /admin/deluser.php endpoint when the attacker has admin authority, via the `id` parameter.

An issue was discovered in zzcms, where there is a SQL injection vulnerability in the /dl/dl sendsms.php endpoint when the attacker has dls print authority, via the `dlid` cookie.

An issue was discovered in zzcms, where there is a SQL injection vulnerability in the /dl/dl sendmail.php endpoint when the attacker has dls print authority. This vulnerability can be exploited via the `dlid` cookie.

An issue was discovered in the software, which allows for SQL injection via the `id` parameter in the "/admin/dl sendmail.php" API endpoint when an attacker has admin authority.

An issue exists in the software, allowing SQL Injection in the /admin/dl sendsms.php endpoint via the `id` parameter.

An issue exists in zzcms 2019 where SQL Injection is possible in the "dl/dl download.php" endpoint via the `id` parameter when its value contains a trailing comma.

An issue exists in the software where SQL Injection is possible. This occurs in the `dl/dl print.php` file through an `id` parameter value that has a trailing comma.

An issue exists in zzcms 2019 where SQL Injection is possible. This occurs in the user/ztconfig.php file via the `daohang` or `img` POST parameters.

Name of the Vulnerable Software and Affected Versions: MetInfo version 7.0 beta Description: The issue allows attackers to delete and modify ini files in specific locations, including `app/system/language/admin/language general.class.php` and `app/system/include/function/file.func.php`. Recommendations: For MetInfo version 7.0 beta, consider restricting access to the vulnerable files until a patch is available. As a temporary workaround, restrict modifications to ini files in the affected locations to minimize the risk of exploitation.