CVE-2024-58284

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.08% chance of exploitation in the next 30 days, 63th percentile

Published

2025-12-10

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52022

References

• CVE Record
• NVD entry

Related

• CVE-2024-58283
• CVE-2024-58285
• CVE-2024-58282
• CVE-2024-58286
• CVE-2024-58281
• CVE-2024-58287