PT-2024-22420 · Semcms · Semcms

Turabiaslan · Published 2024-03-29 · Updated 2025-04-04 · CVE-2024-28405

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEMCMS version 4.8

Description The issue arises from incorrect access control in the code, specifically where SEMCMS Funtion.php is installed before verifying the admin's validity on the admin page. This occurs because the authentication function is called from the admin page, allowing users to gain admin privileges.

Recommendations For SEMCMS version 4.8, consider temporarily restricting access to the admin page until a proper fix is implemented to ensure correct authentication and access control. Additionally, review the authentication function to ensure it is properly validating user credentials before granting access to sensitive areas of the application. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-28405

Affected Products

Semcms

References · 8

• 🔥 https://github.com/turabiaslan/semcms · Exploit
• 🔥 https://github.com/turabiaslan/semcms/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28405 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28405 · Vendor Advisory
• https://t.me/cvenotify/88257 · Telegram Post
• https://twitter.com/CVEnew/status/1773721250398867734 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1773752948926910701 · Twitter Post
• https://t.me/cvenotify/117805 · Telegram Post