PT-2024-20384 · Leptoncms · Leptoncms

Tmrswrr · Published 2024-01-25 · Updated 2024-06-07 · CVE-2024-24399

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LeptonCMS version 7.0.0

Description An arbitrary file upload vulnerability allows authenticated attackers to execute arbitrary PHP code by uploading crafted PHP files to the backend/languages/index.php languages area. This enables the execution of arbitrary code via the uploaded files.

Recommendations For LeptonCMS version 7.0.0, consider disabling the file upload functionality in the backend/languages/index.php area until a patch is available to prevent exploitation. Restrict access to the languages area to minimize the risk of arbitrary code execution. Avoid using the file upload feature in the affected area until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-24399

Affected Products

Leptoncms

References · 11

• 🔥 https://github.com/capture0x/leptoncms/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24399 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24399 · Vendor Advisory
• https://exploit-db.com/exploits/51949 · Note
• https://twitter.com/VulmonFeeds/status/1750665696764133874 · Twitter Post
• https://twitter.com/CVEnew/status/1750619155785765218 · Twitter Post
• https://t.me/cvenotify/75058 · Telegram Post
• https://t.me/cvenotify/82320 · Telegram Post
• https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html · Note
• https://t.me/cvenotify/75285 · Telegram Post
• https://github.com/capture0x/leptoncms · Note