PT-2025-3398 · Unknown · Youdiancms

Yahaha9 · Published 2025-01-09 · Updated 2025-01-28 · CVE-2024-57052

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouDianCMS versions 9.5.20 and earlier

Description The issue allows a remote attacker to escalate privileges via the sessionID parameter in the "index.php" file. This is related to incorrect session management, which can lead to privilege escalation or denial of service.

Recommendations For versions 9.5.20 and earlier, consider disabling the sessionID parameter in the "index.php" file as a temporary workaround until a patch is available. Restrict access to the "index.php" file to minimize the risk of exploitation. Avoid using the sessionID parameter in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Session Fixation

Weakness Enumeration

CWE-434

CWE-384

Related Identifiers

BDU:2025-01305

CVE-2024-57052

Affected Products

Youdiancms

References · 8

• https://bdu.fstec.ru/vul/2025-01305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57052 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57052 · Vendor Advisory
• https://t.me/cvenotify/108797 · Telegram Post
• https://vuldb.com/?id.293896 · Note
• https://twitter.com/CVEnew/status/1884183348962279779 · Twitter Post
• https://gist.github.com/yahaha9/720fb45bbebda62dc198568c8d275df8 · Note
• https://t.me/cvedetector/16554 · Telegram Post