Remote Code Execution Vulnerability in SeaCMS 12.9 by Fushuling

CVE-2024-40520

What is CVE-2024-40520?

SeaCMS version 12.9 presents a vulnerability that enables remote code execution due to improper handling of user input. Specifically, the admin_config_mark.php file directly splices and writes user-provided data into the inc_photowatermark_config.php file without adequate sanitization or validation. This oversight allows authenticated attackers to exploit the vulnerability, executing arbitrary commands on the server and potentially gaining unauthorized access to sensitive system permissions. It is essential for users of SeaCMS 12.9 to take prompt actions to mitigate this security risk by applying necessary patches or implementing appropriate security controls.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References