CVE-2024-40520: Input Validation

Published Jul 12, 2024

Updated

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminconfigmark.php directly splicing and writing the user input data into incphotowatermarkconfig.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.

Affected Software

1 affected component

SEACMS SEACMS=12.9

Event History

Jul 12, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-40520?

CVE-2024-40520 is classified as a remote code execution vulnerability, which is considered highly severe.

How do I fix CVE-2024-40520?

To fix CVE-2024-40520, ensure user input is properly sanitized before being written to inc_photowatermark_config.php.

Who is affected by CVE-2024-40520?

CVE-2024-40520 affects users of SeaCMS version 12.9.

What type of attack does CVE-2024-40520 enable?

CVE-2024-40520 enables authenticated attackers to execute arbitrary code on the affected system.

What component of SeaCMS is vulnerable in CVE-2024-40520?

The vulnerability in CVE-2024-40520 arises from the admin_config_mark.php script allowing unsafe user input handling.