CVE-2024-58284

PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

Affected

PopojiCMS

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.10% chance of exploitation in the next 30 days, 65th percentile

Published

2025-12-10

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52022

Security advisories

• https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated…
• PopojiCMS/PopojiCMS
• https://www.popojicms.org

References

• CVE Record
• NVD entry