CVE-2020-23630

HighCVSS 8.8

Published: 11/01/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.20%

64th percentile - higher than 64% of all known CVEs

Summary

A blind SQL injection vulnerability based on time exists in zzcms version 201910, exploitable through cookie manipulation. An attacker can inject malicious SQL queries via cookie parameters, leading to unauthorized database access.

Risk Assessment

The risk involves potential theft or modification of database data, compromising the confidentiality and integrity of information stored in the zzcms system.

Recommendation

Immediately upgrade zzcms to the latest available version that includes SQL injection fixes. Additionally, implement input validation and sanitization for all user-supplied data, including cookies.

Other vulnerabilities in zzcms

CVE-2023-36162High
ZZCMS versions 2023 and earlier have a Cross Site Request Forgery vulnerability that allows a remote attacker to gain privileges via the add function in adminlist.php.

Original NVD description (English source)

A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS