CVE-2014-4034

Vulnerability

CVE-2014-4034 is a SQL injection vulnerability in the article_id parameter of zero_view_article.php in ZeroCMS 1.0 [1][2]. The application fails to sanitize user-supplied input before incorporating it into a SQL query, enabling an attacker to inject arbitrary SQL commands. The vulnerable code path is reachable via a standard HTTP GET request without requiring any authentication or special privileges [2][3]. The advisory published by Steffen Rösemann later confirmed that the same vulnerability exists in versions up to and including 1.3.3 [2][3].

Exploitation

An unauthenticated remote attacker can exploit the vulnerability by sending a crafted HTTP GET request to the /views/zero_view_article.php script with a malicious article_id parameter [2][3]. For example, visiting http://{TARGET}/views/zero_view_article.php?article_id=-1+union+select+database() ,2,version(),user(),5,6--+ directly extracts database metadata [2][3]. No prior authentication, session cookie, or user interaction is required; the only precondition is that the target runs a vulnerable version of ZeroCMS [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database [1][2]. This can lead to unauthorized retrieval of sensitive information (e.g., user credentials, application data), potential modification or deletion of database content, and, in some configurations, escalation to operating system command execution [2][3]. The attacker gains the full privileges of the database user under which the web application operates [2][3].

Mitigation

As of the available references, no official patch has been released for ZeroCMS to address CVE-2014-4034 [2][3]. The vendor indicated that the platform would be moving to Rails 4 but did not provide a specific fix for the vulnerable PHP code [2]. Administrators are advised to isolate the application from untrusted networks, apply input sanitization manually, or consider migrating to an alternative CMS that is actively maintained [2][3]. There is no indication that this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.