CVE-2020-24949

HIGHNuclei

PHP-Fusion 9.03.50 downloads/downloads.php Authenticated Remote Code Execution

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-24949 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 16, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

php-fusion

Browse php-fusion / php-fusion
VulnCheckVersion data not supplied

Proofs of concept

2

Catalogued exploits

ExploitDBPHPFusion 9.03.50 - Remote Code ExecutionExploitDB exploitby g0ldm45kNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubr90tpass/CVE-2020-24949Repository PoCby r90tpass0Not analyzed1 file

1.8 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHPHP-Fusion 9.03.50 - Remote Code ExecutionCVSS 8.8

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to full compromise.

Remediation

Apply the latest security patch or upgrade to a non-vulnerable version of PHP-Fusion.

WeaknessesCWE-77
Authorsgeeknik
Template tagscvecve2020rcephppacketstormphpfusionphp-fusionvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:php-fusion:php-fusion:9.03.50:*:*:*:*:*:*:*
https://packetstormsecurity.com/files/162852/phpfusion90350-exec.txt https://github.com/php-fusion/PHP-Fusion/issues/2312 http://packetstormsecurity.com/files/162852/PHPFusion-9.03.50-Remote-Code-Execution.html https://nvd.nist.gov/vuln/detail/CVE-2020-24949 https://github.com/404notf0und/CVE-Flow

Source: ProjectDiscovery

References

3