// For flags

CVE-2024-10505

wuzhicms block.php edit code injection

Severity Score

5.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.

Se ha encontrado una vulnerabilidad en wuzhicms 4.1.0. Se ha clasificado como crítica. La función add/edit del archivo www/coreframe/app/content/admin/block.php está afectada. La manipulación provoca la inyección de código. Es posible lanzar el ataque de forma remota. El exploit se ha hecho público y puede utilizarse. Inicialmente, el investigador creó dos problemas separados para las diferentes llamadas de función. Se contactó al proveedor con anticipación sobre esta revelación, pero no respondió de ninguna manera.

Es wurde eine kritische Schwachstelle in wuzhicms 4.1.0 ausgemacht. Betroffen hiervon ist die Funktion add/edit der Datei www/coreframe/app/content/admin/block.php. Durch Manipulieren mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.

*Credits: LVZC
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
Low
None
Integrity
Low
None
Availability
Low
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-10-29 CVE Reserved
  • 2024-10-30 CVE Published
  • 2024-10-30 CVE Updated
  • 2024-10-30 First Exploit
  • 2024-11-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (3)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
---- -