CVE-2024-58284highCWE-94

PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 1.1%

probabilidad de explotación

1.1%top 36% de las CVE

explotación observada

noninguna fuente lo reporta

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

PopojiCMS · PopojiCMS

Referencias

https://github.com/PopojiCMS/PopojiCMS https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip https://www.exploit-db.com/exploits/52022 https://www.popojicms.org/https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings