CVE-2024-46640

CRITICAL

SeaCMS 13.2 - Remote Code Execution via MySQL Slow Query Method

Title source: llm

Description

SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://gitee.com/zheng_botong/CVE-2024-46640

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0288

EPSS Percentile 86.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (1)

seacms/seacms 13.2

Published Sep 20, 2024

Tracked Since Feb 18, 2026