CVE-2024-40518

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2024-07-12

Last modified

2024-08-02

Weaknesses

CWE-20

Affected products

• Seacms (Seacms)

References

• https://gitee.com/fushuling/cve/blob/master/SeaCMS%2012.9%20admin_weixin.php%20code%20injection.md