PT-2024-28896 · Seacms · Seacms

Published 2024-07-12 · Updated 2024-08-01 · CVE-2024-40520

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS version 12.9

Description The issue is caused by the admin config mark.php file directly splicing and writing user input data into inc photowatermark config.php without processing it. This allows authenticated attackers to execute arbitrary commands and obtain system permissions.

Recommendations For SeaCMS version 12.9, consider disabling the admin config mark.php file or restricting its access until a patch is available to prevent exploitation. Additionally, restrict write access to the inc photowatermark config.php file to minimize the risk of arbitrary command execution.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-40520

Affected Products

Seacms

References · 4

• 🔥 https://gitee.com/fushuling/cve/blob/master/SeaCMS%2012.9%20admin_config_mark.php%20code%20injection.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-40520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40520 · Security Note
• https://t.me/cvenotify/86106 · Telegram Post