ZKEACMS vulnerabilities

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.

A vulnerability was detected in ZKEACMS 4.3 in the Proxy function of MediaController.cs. Manipulating the url argument results in server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.