CVE-2024-10505
wuzhicms block.php edit code injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 30, 2024
- Updated
- Oct 30, 2024
- Reserved
- Oct 29, 2024
Description
A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-94 Code Injection
Affected Products
| Product | Versions |
|---|---|
wuzhicmsn/a |
|
References
- VDB-282444 | wuzhicms block.php edit code injectionvdb-entrytechnical-description
- VDB-282444 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #427401 | Beijing Wuzhi Internet Technology Co., Ltd wuzhicms 4.1.0 Remote Command Executionthird-party-advisory
- https://github.com/wuzhicms/wuzhicms/issues/209exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.