PT-2024-33175 · Unknown · Total.Js Cms

Piggyctf · Published 2024-10-25 · Updated 2025-05-27 · CVE-2024-48655

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Total.js CMS version 1.0

Description The issue allows a remote attacker to execute arbitrary code via the func.js file.

Recommendations For Total.js CMS version 1.0, update the func.js file to prevent arbitrary code execution or consider disabling the func.js file until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-48655

Affected Products

Total.Js Cms

References · 6

• 🔥 https://medium.com/%400x0d0x0a/cve-2024-48655-server-side-javascript-code-injection-in-total-js-cms-c5fc18359bdc · Exploit
• https://github.com/totaljs/cms/issues/49 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48655 · Security Note
• https://t.me/cvedetector/8960 · Telegram Post
• https://t.me/cvenotify/123749 · Telegram Post