PT-2024-17789 · Foxcms · Foxcms

Glzjin · Published 2024-12-23 · Updated 2025-07-15 · CVE-2024-12901

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FoxCMS versions up to 1.2

Description A critical issue was found in the API Endpoint component, specifically in the file /app/api/controller/Site.php. The manipulation of the password argument leads to improper authorization, allowing for remote attacks. The issue has been publicly disclosed and may be exploited.

Recommendations For FoxCMS versions up to 1.2, update to a version that fixes the improper authorization issue. As a temporary workaround, consider restricting access to the API Endpoint, specifically the file /app/api/controller/Site.php, to minimize the risk of exploitation. Avoid using the password argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2024-12901

Affected Products

Foxcms

References · 10

• 🔥 https://note.zhaoj.in/share/8l4RPA2zcxRr · Exploit
• https://osv.dev/vulnerability/CVE-2024-12901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12901 · Security Note
• https://vuldb.com/?id.289171 · Note
• https://vuldb.com/?submit.467703 · Note
• https://twitter.com/VulmonFeeds/status/1871028910969761816 · Twitter Post
• https://t.me/cvedetector/13529 · Telegram Post
• https://t.me/cvenotify/105270 · Telegram Post
• https://vuldb.com/?ctiid.289171 · Note
• https://t.me/cvenotify/129098 · Telegram Post