CVE-2024-58284 — HIGH (7.2)

Vulnerability Description

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Popojicms	Popojicms	2.0.1

Related Weaknesses (CWE)

CWE-94

References

https://github.com/PopojiCMS/PopojiCMSProduct
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zipRelease Notes
https://www.exploit-db.com/exploits/52022ExploitThird Party Advisory
https://www.popojicms.org/Product
https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authThird Party Advisory
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zipRelease Notes

FAQ

What is CVE-2024-58284?

CVE-2024-58284 is a vulnerability with a CVSS score of 7.2 (HIGH). PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log...

How severe is CVE-2024-58284?

CVE-2024-58284 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-58284?

Check the references section above for vendor advisories and patch information. Affected products include: Popojicms Popojicms.