PT-2024-39934 · Huangdou · Huangdou Utcms

Chenzijie0619 · Published 2024-10-13 · Updated 2024-10-19 · CVE-2024-9917

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HuangDou UTCMS version V9

Description A critical issue was found in HuangDou UTCMS, affecting an unknown part of the file app/modules/ut-template/admin/template creat.php. The manipulation of the content argument leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For HuangDou UTCMS version V9, as a temporary workaround, consider restricting access to the template creat.php file until a patch is available. Avoid using the content argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-9917

Affected Products

Huangdou Utcms

References · 10

• 🔥 https://github.com/DeepMountains/zzz/blob/main/CVE5-2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9917 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9917 · Vendor Advisory
• https://vuldb.com/?ctiid.280245 · Note
• https://t.me/cvenotify/98831 · Telegram Post
• https://twitter.com/CVEnew/status/1845549560287899843 · Twitter Post
• https://t.me/cvenotify/97956 · Telegram Post
• https://vuldb.com/?submit.418749 · Note
• https://t.me/cvedetector/7792 · Telegram Post
• https://vuldb.com/?id.280245 · Note