CVE-2024-10505: wuzhicms block.php edit code injection

Published Oct 30, 2024

Updated

A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/block.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Initially two separate issues were created by the researcher for the different function calls. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Wuzhicms Wuzhicms=4.1.0

Event History

Oct 30, 2024

CVE Published

via MITRE·01:31 AM

Data Sourced

via MITRE·01:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-10505?

CVE-2024-10505 has been classified as critical due to its potential for code injection vulnerabilities.

How does CVE-2024-10505 affect Wuzhi CMS?

CVE-2024-10505 affects Wuzhi CMS version 4.1.0, specifically the add/edit function in the admin block.php file.

Can CVE-2024-10505 be exploited remotely?

Yes, CVE-2024-10505 can be exploited remotely, allowing attackers to manipulate code injection vulnerabilities from a distance.

What are the potential impacts of CVE-2024-10505?

The exploitation of CVE-2024-10505 can lead to unauthorized code execution and control over affected systems.

How do I fix CVE-2024-10505?

To fix CVE-2024-10505, upgrade to a patched version of Wuzhi CMS that addresses this critical vulnerability.