PT-2024-28337 · Seacms · Seacms

Published 2024-07-05 · Updated 2024-08-01 · CVE-2024-39028

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS versions <=12.9

Description An issue in SeaCMS allows remote attackers to execute arbitrary code via the "admin ping.php" endpoint. This enables attackers to run malicious code on the affected system.

Recommendations For SeaCMS versions <=12.9, update to a version greater than 12.9 to resolve the issue. As a temporary workaround, consider restricting access to the "admin ping.php" endpoint until a patch is available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-39028

Affected Products

Seacms

References · 7

• 🔥 https://github.com/pysnow1/vul_discovery/blob/main/SeaCMS/SeaCMS%20v12.9%20admin_ping.php%20RCE.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-39028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39028 · Security Note
• https://t.me/cvedetector/100 · Telegram Post
• https://twitter.com/cracbot/status/1810554559712104662 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1809268465359790356 · Twitter Post
• https://twitter.com/CVEnew/status/1809229326396617106 · Twitter Post