CVE-2019-12356

Name of the Vulnerable Software and Affected Versions zzcms version 2019

Description An issue was discovered in the software, which is a SQL injection vulnerability. This vulnerability exists in the /user/dls download.php endpoint when the attacker has dls download authority, and it can be exploited via the id parameter.

Recommendations For zzcms version 2019, consider restricting access to the /user/dls download.php endpoint until a patch is available, and avoid using the id parameter in this endpoint to minimize the risk of exploitation.