PT-2024-16325 · Wuzhicms · Wuzhi Cms

Lvzc · CVE-2024-10505 · Published 2024-10-30 · Updated 2024-11-06

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions wuzhicms version 4.1.0

Description A critical issue has been found, affecting the add/edit function of the file www/coreframe/app/content/admin/block.php. This leads to code injection and can be exploited remotely. The issue has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations For wuzhicms version 4.1.0, consider disabling the add/edit function in the www/coreframe/app/content/admin/block.php file as a temporary workaround until a patch is available. Restrict access to this function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-10505

Affected Products

Wuzhi Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10505.json · Exploit
• 🔥 https://github.com/wuzhicms/wuzhicms/issues/209 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10505 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10505 · Vendor Advisory
• https://vuldb.com/?ctiid.282444 · Note
• https://vuldb.com/?id.282444 · Note
• https://t.me/cvenotify/99985 · Telegram Post
• https://twitter.com/UndercodeNews/status/1854274210786578882 · Twitter Post
• https://t.me/cvenotify/100833 · Telegram Post
• https://vuldb.com/?submit.427401 · Note
• https://t.me/cvedetector/9388 · Telegram Post