PT-2024-22846 · Seacms · Seacms

Hebing123 · Published 2024-03-21 · Updated 2024-08-01 · CVE-2024-29275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS version 12.9

Description The issue allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php. This enables attackers to potentially access and manipulate sensitive data without proper authorization.

Recommendations For SeaCMS version 12.9, consider restricting access to the id parameter in class.php until a patch is available. As a temporary workaround, disabling the execution of arbitrary code via the id parameter can help minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-29275

Affected Products

Seacms

References · 7

• 🔥 https://github.com/Cyphercoda/nuclei_template · Exploit
• https://github.com/seacms-net/CMS/issues/15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29275 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29275 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1771122579446653242 · Twitter Post
• https://t.me/cvenotify/74412 · Telegram Post
• https://twitter.com/CVEnew/status/1771033454219522385 · Twitter Post