CVE-2024-58284
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- popojicms/popojicms
- Source
- disclosure@vulncheck.com
References
- https://github.com/PopojiCMS/PopojiCMSProduct
- https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zipRelease Notes
- https://www.exploit-db.com/exploits/52022Exploit, Third Party Advisory
- https://www.popojicms.org/Product
- https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settingsThird Party Advisory
- https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zipRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.