CVE-2024-39914

CRITICAL EXPLOITED NUCLEI

fogproject < 1.5.10.34 - Command Injection via Filename Parameter

Title source: llm

Exploitation Summary

CVE-2024-39914 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including 9874621368. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-39914, a command injection vulnerability in FOG Project. The exploit uses DNS exfiltration via dnslog.cn to confirm remote code execution by injecting a curl command into the 'filename' parameter of the export.php endpoint.

Description

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.

Exploits (1)

nomisec WORKING POC

by 9874621368 · remote

https://github.com/9874621368/FOG-Project

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2024-39914, a command injection vulnerability in FOG Project. The exploit uses DNS exfiltration via dnslog.cn to confirm remote code execution by injecting a curl command into the 'filename' parameter of the export.php endpoint.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: FOG Project (version not specified)

No auth needed

Prerequisites: Network access to the target FOG Project instance · DNS exfiltration service (dnslog.cn)

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

FOG Project < 1.5.10.34 - Remote Command Execution

CRITICALby s4e-io

FOFA: icon_hash="-1952619005"

References (2)

Core 2

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j

Patch x_refsource_misc

https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f

View Patch ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.2341

EPSS Percentile 97.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2024-12-05

CWE

CWE-77

Status published

Products (1)

fogproject/fogproject < 1.5.10.41

Published Jul 12, 2024

Tracked Since Feb 18, 2026