> For the complete documentation index, see [llms.txt](https://kongxin.gitbook.io/zzcms-8-2-bug/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kongxin.gitbook.io/zzcms-8-2-bug/master.md).

# zzcms\_8.2\_Bug

zzcms 8.2 bug

> \[Suggested description]\
> zzcms 8.2 allows remote attackers to discover the full path via a direct request to /3/qq\_connect2.0/API/class/ErrorCase.class.php or /3/ucenter\_api/code/friend.php.
>
> \[Additional Information]\
> The vulnerability was discovered by downloading the program's source code to local and online deployment tests.
>
> Location :\
> domain/3/qq\_connect2.0/API/class/ErrorCase.class.php
>
> Code :\
> require\_once(CLASS\_PATH."Recorder.class.php");\
> \
> Rows : 8\
> \
> Return error :\
> Notice: Use of undefined constant CLASS\_PATH - assumed 'CLASS\_PATH' in /www/3/qq\_connect2.0/API/class/ErrorCase.class.php on line 8\
> Warning: require\_once(CLASS\_PATHRecorder.class.php): failed to open stream: No such file or directory in /www/3/qq\_connect2.0/API/class/ErrorCase.class.php on line 8\
> Fatal error: require\_once(): Failed opening required 'CLASS\_PATHRecorder.class.php' (include\_path='.;C:\php\pear') in /www/3/qq\_connect2.0/API/class/ErrorCase.class.php on line 8
>
> Harm:\
> Web Site physical path leakage .
>
> Conditions for Execution :\
> Normal access can
>
> Edition :\
> zzcms 8.2
>
> Cause the cause :\
> require\_once(): Failed opening required 'CLASS\_PATHRecorder.class.php' (include\_path='.;C:\php\pear') in /www/3/qq\_connect2.0/API/class/ErrorCase.class.php, cause path leakage.
>
> POC :\
> <http://127.0.0.1/3/qq_connect2.0/API/class/ErrorCase.class.php>
>
> Location :\
> domain/3/ucenter\_api/code/friend.php
>
> Code :\
> $num = uc\_friend\_totalnum($Example\_uid);
>
> Rows : 14
>
> Return error :\
> Fatal error: Call to undefined function uc\_friend\_totalnum() in /www/3/ucenter\_api/code/friend.php on line 14
>
> Harm :\
> Web Site physical path leakage .
>
> Conditions for Execution :\
> Normal access can
>
> Edition :\
> zzcms 8.2
>
> Cause the cause :\
> Call to undefined function uc\_friend\_totalnum() in /www/3/ucenter\_api/code/friend.php, cause path leakage.
>
> POC :\
> <http://127.0.0.1/3/ucenter_api/code/friend.php>
>
> fix suggestions :\
> Modify the application source code to avoid information leakage.
>
> \[VulnerabilityType Other]\
> Physical path leaked
>
> \[Vendor of Product]\
> ZZCMS
>
> \[Affected Product Code Base]\
> zzcms - 8.2
>
> \[Affected Component]\
> ErrorCase.class.php , Use of undefined constant CLASS\_PATH - assumed 'CLASS\_PATH' , require\_once(): Failed opening required 'CLASS\_PATHRecorder.class.php'
>
> \[Attack Type]\
> Remote
>
> \[Impact Information Disclosure]\
> true
>
> \[Attack Vectors] The vulnerability is triggered by accessing the following URL : <http://127.0.0.1/3/qq_connect2.0/API/class/ErrorCase.class.php>\
> <http://127.0.0.1/3/ucenter_api/code/friend.php>
>
> \[Discoverer]\
> kongxin