CVE-2022-23881

Deeper analysis

ZZZCMS zzzphp version 2.1.0 contains a remote command execution vulnerability in the danger_key function located in zzz_template.php. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability.

An unauthenticated attacker can send crafted input over the network to trigger arbitrary command execution on the affected system. Public proof-of-concept material demonstrates the issue and confirms that successful exploitation yields full control of the application and underlying host.

The two reference URLs consist of technical write-ups and reproduction steps hosted on GitHub; they contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained at 0.8666 since disclosure with no material upward trajectory observed.