CVE-2022-23881: ZZZCMS zzzphp danger_key() remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable RCE with a 9.8 CVSS score and public exploit code, though not yet in KEV.

What it is

ZZZCMS zzzphp v2.1.0 contains a remote command execution flaw reached through the danger_key() function in zzz_template.php. The CVSS 3.1 base score is 9.8 (critical) with a network vector and no privileges or user interaction required, so an unauthenticated attacker can execute commands on an exposed instance.

Impact

An attacker gains arbitrary command execution on the web server, which typically means full control of the application and its host data.

Attack surface

Reached over the network via HTTP against the zzzphp template handling path; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.56509 (99.0th percentile) and both references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade zzzphp past v2.1.0 to a fixed release; no fixed version is stated in this record, so confirm with the vendor.
• If upgrade is not possible, remove or restrict access to the affected template functionality and block external requests to zzz_template.php paths.
• Place the application behind a WAF or reverse proxy with rules blocking command-injection patterns in template parameters.
• Run the web service with least privilege and restrict outbound network access to limit post-exploitation movement.

Detection

• Monitor web server logs for requests to zzz_template.php with shell metacharacters or command-like payloads.
• Alert on unexpected child processes spawned by the web server user (for example sh, bash, curl, wget).
• Review outbound connections from the web host to unfamiliar IPs or ports.
• Check for newly written files in web-accessible directories or modified template files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.