PT-2024-30053 · Seacms · Seacms

Published 2024-08-22 · Updated 2024-08-26 · CVE-2024-42599

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS version 13.0

Description The issue is related to a remote code execution vulnerability. Although the admin files.php file imposes restrictions on edited files, attackers can bypass these restrictions and write code. This allows authenticated attackers to exploit the vulnerability, execute arbitrary commands, and gain system privileges.

Recommendations For SeaCMS version 13.0, consider disabling the editing functionality in admin files.php as a temporary workaround until a patch is available. Restrict access to the admin files.php file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-42599

Affected Products

Seacms

References · 8

• 🔥 https://gitee.com/fushuling/cve/blob/master/CVE-2024-42599.md · Exploit
• 🔥 https://gitee.com/fushuling/cve/blob/master/SeaCMS%20V13%20admin_files.php%20code%20injection.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-42599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42599 · Security Note
• https://t.me/cvedetector/3953 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1826755549146255439 · Twitter Post
• https://twitter.com/cracbot/status/1828311582205460786 · Twitter Post
• https://twitter.com/CVEnew/status/1826701731121574397 · Twitter Post