CVE-2025-4541 - LmxCMS POST Request ZtAction.class.php manageZt sql injection

Back Back to CVE browser

MEDIUM

LmxCMS POST Request ZtAction.class.php manageZt sql injection

Published May 11, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.51%

Description

A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component POST Request Handler. The manipulation of the argument sortid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product LmxCMS Default
n/a
- Version
  1.41
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

LmxCMS

n/a

Version	Status	Constraints
1.41	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (4)

https://github.com/xiaoyangsec/LmxCMS-SQL-Injection/blob/main/LmxCMS-SQL-Injection.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.308286
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.308286
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.567191
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/xiaoyangsec/LmxCMS-SQL-Injection/blob/main/LmxCMS-SQL-Injection.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.308286		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.308286		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.567191		third-party-advisoryThird Party AdvisoryVDB Entry