Cyber Resilience

CVE-2022-23881

Zzzcms Zzzphp 2.1.0

Public PoCHigh EPSS
Published
23 March 2022
Modified
21 November 2024
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.57 99th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2022-23881 is a critical-severity an unspecified weakness vulnerability in Zzzcms Zzzphp. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

ZZZCMS zzzphp version 2.1.0 contains a remote command execution vulnerability in the danger_key function located in zzz_template.php. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability.

An unauthenticated attacker can send crafted input over the network to trigger arbitrary command execution on the affected system. Public proof-of-concept material demonstrates the issue and confirms that successful exploitation yields full control of the application and underlying host.

The two reference URLs consist of technical write-ups and reproduction steps hosted on GitHub; they contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained at 0.8666 since disclosure with no material upward trajectory observed.

EU & UK References

Vulnerability Data

ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.

CWE(s)
NVD-CWE-Other

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated remote command execution via crafted input to a publicly exposed web application directly matches exploitation of a public-facing application.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: HIGH
The vulnerability permits arbitrary command execution on the host, enabling use of a command or scripting interpreter.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-45909Same product: Zzzcms Zzzphp
CVE-2023-45555Same vendor: Zzzcms
CVE-2023-5263Same vendor: Zzzcms
CVE-2023-5582Same vendor: Zzzcms
CVE-2023-45554Same vendor: Zzzcms
CVE-2019-9082Same product: Zzzcms Zzzphp

Affected Assets

zzzcms
zzzphp
2.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks the unauthenticated crafted input that danger_key() fails to sanitize, preventing RCE before execution.

AC-3 Access Enforcement good match
prevent

Enforces authentication and authorization checks on template-processing functions so unauthenticated attackers cannot reach the vulnerable code path.

AC-6 Least Privilege partial match
prevent

Limits privileges of the web-server process, reducing the blast radius and host-level compromise even if the RCE succeeds.

References