PT-2024-22533 · Unknown · Mblog Blog System

Secatgourity · Published 2024-03-28 · Updated 2025-09-23 · CVE-2024-28713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mblog Blog system version 3.5.0

Description An issue in the theme management feature allows an attacker to execute arbitrary code via a crafted file.

Recommendations For Mblog Blog system version 3.5.0, consider disabling the theme management feature until a patch is available to prevent exploitation. Restrict access to this feature to minimize the risk of arbitrary code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-28713

Affected Products

Mblog Blog System

References · 14

• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.png · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.png · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.png · Exploit
• 🔥 https://vicarius.io/vsociety/posts/ssti-in-mblog-351-a-tale-of-a-glorified-rce-cve-2024-28713-28714 · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.png · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/Mblog%20blog%20system%20has%20SSTI%20template%20injection%20vulnerability.md · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.png · Exploit
• https://osv.dev/vulnerability/CVE-2024-28713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28713 · Security Note
• https://gitee.com/mtons/mblog · Note
• https://t.me/cveNotify/136081 · Telegram Post
• http://mblog.com · Note
• https://t.me/cvenotify/75025 · Telegram Post
• https://twitter.com/CVEnew/status/1773461416277905918 · Twitter Post