CVE-2024-40519

Published Jul 12, 2024

Last updated 4 months ago

Overview

Description: SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:seacms:seacms:12.9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5A52C0BF-703A-4BF0-A5A9-E3995C30FE0D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References