PT-2024-31307 · Seacms · Seacms

Nn0Nkey · Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-44921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS version 12.9

Description A SQL injection vulnerability was discovered in SeaCMS via the id parameter at the "/dmplayer/dmku/index.php?ac=del" endpoint. This issue allows for potential SQL injection attacks.

Recommendations For SeaCMS version 12.9, consider disabling the id parameter in the "/dmplayer/dmku/index.php?ac=del" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the id parameter in this endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-44921

Affected Products

Seacms

References · 10

• 🔥 https://github.com/nn0nkey/nn0nkey/blob/main/CVE-2024-44921.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-44921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44921 · Security Note
• https://twitter.com/CVEnew/status/1830953584869155008 · Twitter Post
• https://twitter.com/cracbot/status/1832660204321960431 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1830977907008700674 · Twitter Post
• https://t.me/cvenotify/93196 · Telegram Post
• https://t.me/cvenotify/93036 · Telegram Post
• https://t.me/cvedetector/4681 · Telegram Post
• https://t.me/cvenotify/93081 · Telegram Post