PT-2024-25782 · Eyoucms · Eyoucms

V2Ish1Yan · Published 2024-04-07 · Updated 2025-06-05 · CVE-2024-3431

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyouCMS version 1.6.5

Description A critical issue affects the Backend component of EyouCMS, specifically the file /login.php?m=admin&c=Field&a=channel edit. The manipulation of the channel id argument leads to deserialization. This issue can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations For EyouCMS version 1.6.5, as a temporary workaround, consider restricting access to the /login.php?m=admin&c=Field&a=channel edit endpoint until a patch is available. Avoid manipulating the channel id argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-3431

Affected Products

Eyoucms

References · 8

• 🔥 https://terrific-street-3d0.notion.site/EYOUCMS-v1-6-5-RCE-7fe12e91a9b249e88e6ab36446b5ba22 · Exploit
• https://osv.dev/vulnerability/CVE-2024-3431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3431 · Security Note
• https://vuldb.com/?submit.308208 · Note
• https://t.me/cvenotify/75983 · Telegram Post
• https://vuldb.com/?ctiid.259612 · Note
• https://t.me/cvenotify/124817 · Telegram Post
• https://vuldb.com/?id.259612 · Note