CVE-2024-37791

MEDIUM

DuxCMS3 v3.1.3 - SQL Injection via Keyword Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-37791. PoCs published by czheisenberg.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2024-37791, a time-based blind SQL injection vulnerability in DuxCMS 3.1.3. It includes root cause analysis, vulnerable code snippets, and proof-of-concept payloads demonstrating the exploit.

Description

DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.

Exploits (1)

nomisec WRITEUP 1 stars

by czheisenberg · poc

https://github.com/czheisenberg/CVE-2024-37791

View Code ZIP pw:eip

This repository provides a detailed technical analysis of CVE-2024-37791, a time-based blind SQL injection vulnerability in DuxCMS 3.1.3. It includes root cause analysis, vulnerable code snippets, and proof-of-concept payloads demonstrating the exploit.

Classification

Writeup 95%

Attack Type

Sqli

Complexity

Moderate

Reliability

Reliable

Target: DuxCMS 3.1.3

Auth required

Prerequisites: Authenticated access to the DuxCMS backend · Valid session cookie

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Various Sources

https://github.com/duxphp/DuxCMS3/

Issue Tracking

https://github.com/duxphp/DuxCMS3/issues/5

Scores

CVSS v3 6.0

EPSS 0.0061

EPSS Percentile 44.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Published Jun 18, 2024

Tracked Since Feb 18, 2026