PT-2024-17560 · Jfinalcms · Jfinalcms

Hadagaga + 1 · Published 2024-12-08 · Updated 2024-12-11 · CVE-2024-12350

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFinalCMS version 1.0

Description The issue is related to incorrect code generation management in the Template Handler component of the JFinalCMS system. Exploitation of this issue may allow a remote attacker to execute arbitrary code. The vulnerability affects the update function of the Template Handler component, specifically the manipulation of the content argument, leading to command injection. The attack can be launched remotely.

Recommendations For JFinalCMS version 1.0, as a temporary workaround, consider disabling the update function of the Template Handler component until a patch is available. Restrict access to the Template Handler component to minimize the risk of exploitation. Avoid using the content argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Code Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-94

CWE-77

Related Identifiers

BDU:2025-01102

CVE-2024-12350

Affected Products

Jfinalcms

References · 10

• 🔥 https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Server_Side%20_Template_Injection/Server-Side-Template-Injection.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-12350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12350 · Security Note
• https://bdu.fstec.ru/vul/2025-01102 · Security Note
• https://t.me/cvedetector/12339 · Telegram Post
• https://vuldb.com/?id.287270 · Note
• https://twitter.com/VulmonFeeds/status/1865941535981736232 · Twitter Post
• https://vuldb.com/?submit.456047 · Note
• https://t.me/cvenotify/103483 · Telegram Post
• https://vuldb.com/?ctiid.287270 · Note