PT-2024-21919 · Wmcms · Wmcms

Shadow7 · Published 2024-07-19 · Updated 2024-08-01 · CVE-2024-27489

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WMCMS version 4.4

Description An issue in the DelFile() function allows attackers to delete arbitrary files via a crafted POST request.

Recommendations For WMCMS version 4.4, consider disabling the DelFile() function until a patch is available to prevent arbitrary file deletion.

Fix

Weakness Enumeration

CWE-473

CWE-791

Related Identifiers

CVE-2024-27489

Affected Products

Wmcms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-27489 · Security Note
• https://t.me/cvenotify/86763 · Telegram Post
• https://gitee.com/y1336247431/poc-public/issues/I920OW · Note
• https://t.me/cvenotify/87018 · Telegram Post
• https://t.me/cvedetector/1219 · Telegram Post
• https://gist.github.com/yyyyy7777777/a36541cb60d9e55628f78f2a68968212 · Note