CVE-2024-58284

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/PopojiCMS/PopojiCMS	Product
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip	Release Notes
https://www.exploit-db.com/exploits/52022	Exploit Third Party Advisory
https://www.popojicms.org/	Product
https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings	Third Party Advisory
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:popojicms:popojicms:2.0.1:*:*:*:*:*:*:*

History

26 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) PopojiCMS 2.0.1 contiene una vulnerabilidad de ejecución remota de comandos autenticada que permite a usuarios administrativos inyectar código PHP malicioso a través del endpoint de configuración de metadatos. Los atacantes pueden iniciar sesión y modificar el contenido meta para crear una web shell que ejecuta comandos de sistema arbitrarios a través de un parámetro GET.

Information

Published : 2025-12-10 22:16

Updated : 2026-09-26 21:10

NVD link : CVE-2024-58284

Mitre link : CVE-2024-58284

CVE.ORG link : CVE-2024-58284

JSON object : View

Products Affected

popojicms

popojicms

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-58284", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58284", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T15:41:50.009676Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "PopojiCMS", "product": "PopojiCMS", "versions": [{"status": "affected", "version": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-10T22:16:20.420", "references": [{"url": "https://github.com/PopojiCMS/PopojiCMS", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/52022", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.popojicms.org/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip", "tags": ["Release Notes"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter."}, {"lang": "es", "value": "PopojiCMS 2.0.1 contiene una vulnerabilidad de ejecuci\u00f3n remota de comandos autenticada que permite a usuarios administrativos inyectar c\u00f3digo PHP malicioso a trav\u00e9s del endpoint de configuraci\u00f3n de metadatos. Los atacantes pueden iniciar sesi\u00f3n y modificar el contenido meta para crear una web shell que ejecuta comandos de sistema arbitrarios a trav\u00e9s de un par\u00e1metro GET."}], "lastModified": "2026-09-26T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:popojicms:popojicms:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2215DA94-615C-4B2C-BCC4-4497C233208C"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}