Executive brief
Z-BlogPHP is a popular website and blogging platform. A security flaw in its comment management system allows users with low-level 'commenter' accounts to bypass the moderation process. This means an attacker can post and immediately approve their own comments without an administrator's review, potentially leading to the spread of spam, malicious links, or abusive content on the site.
Technical details
An improper authorization vulnerability exists in Z-BlogPHP version 1.7.4.3430 within the 'CheckComment' function of 'zb_system/function/c_system_event.php'. The root cause is a logic error where the application incorrectly treats the comment author as an authorized party for changing the moderation state ('IsChecking' status). A remote attacker with low-privileged 'commenter' credentials can exploit this by directly invoking the 'CommentChk' action via 'cmd.php' with their own comment ID. This allows the attacker to approve their own pending comments, bypassing the intended administrator moderation workflow. Public exploit details and proof-of-concept steps have been disclosed.
Affected products
- Z-BlogPHP Z-BlogPHP 1.7.4.3430
Timeline
- 2026-05-17: advisory: NVD and VulDB published the vulnerability details.