CVE-2024-40518
Last modified
CVE-2024-40518 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Seacms | Seacms | 12.9 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-40518?
How severe is CVE-2024-40518?
How do I fix CVE-2024-40518?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-40511Cross Site Scripting vulnerability in openPetra v.2023.02 al…7.3
- CVE-2024-40512Cross Site Scripting vulnerability in openPetra v.2023.02 al…7.3
- CVE-2024-40513An issue in themesebrand Chatvia v.5.3.2 allows a remote att…4.6
- CVE-2024-40514Insecure Permissions vulnerability in themesebrand Chatvia v…4.6
- CVE-2024-40515An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V…9.8
- CVE-2024-40516An issue in H3C Technologies Co., Limited H3C Magic RC3000 R…8.8
- CVE-2024-40519SeaCMS 12.9 has a remote code execution vulnerability. The v…8.8
- CVE-2024-40520SeaCMS 12.9 has a remote code execution vulnerability. The v…8.8
- CVE-2024-40521SeaCMS 12.9 has a remote code execution vulnerability. The v…8.8
- CVE-2024-40522There is a remote code execution vulnerability in SeaCMS 12.…8.8
- CVE-2024-40524Directory Traversal vulnerability in xmind2testcase v.1.5 al…9.8
- CVE-2024-40530A vulnerability in Pantera CRM versions 401.152 and 402.072 …7.5
Are you affected by CVE-2024-40518?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST