CVE-2024-9916

MEDIUMNuclei

HuangDou UTCMS cli.php os command injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-9916 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 18, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 14, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

UTCMS

Browse HuangDou / UTCMS

Default status: unknown

CVE ListV9affected
v9affected

usualtoolcms

Browse usualtool / usualtoolcms
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHHuangDou UTCMS V9 - OS Command InjectionCVSS 7.3

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The exploit has been disclosed to the public and may be used.The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Unauthenticated attackers can execute arbitrary OS commands on the server through command injection in the cli.php file, achieving complete system compromise and potential access to sensitive data.

Remediation

Apply security patches from HuangDou for UTCMS V9 to address the OS command injection vulnerability in app/modules/ut-cac/admin/cli.php.

WeaknessesCWE-78
Authorsiamnoooob, pdresearch
Template tagscvecve2024huangdouutcrcephpvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE: cpe:2.3:a:usualtool:usualtoolcms:9.0:*:*:*:*:*:*:*
FOFA: body="usualtool"
https://vuldb.com/?ctiid.280244 https://nvd.nist.gov/vuln/detail/CVE-2024-9916

Source: ProjectDiscovery

References

5