CVE-2024-58284

PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

CVSS 8.6 HIGHEPSS 0.9%CWE-94

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.6EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

10 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

PopojiCMS · PopojiCMS

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/PopojiCMS/PopojiCMS https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip https://www.exploit-db.com/exploits/52022 https://www.popojicms.org/https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings