CVE-2024-0603 – ZhiCms giftcontroller.php deserialization

https://notcve.org/view.php?id=CVE-2024-0603

16 Jan 2024 — A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/n3QsNbORUR0e • CWE-502: Deserialization of Untrusted Data •