References https://github.com/0day404/HV-2024-POC/blob/main/Pear-Admin-Boot%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md https://www.ddpoc.com/DVB-2024-7362.html https://avd.aliyun.com/detail?id=AVD-2024-6241 https://www.lmboke.com/archives/lou-dong-yu-jing-pear-admin-boot-sqlzhu-ru-lou-dong https://cn-sec.com/archives/2898380.html https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ https://vuldb.com/vuln/269375 https://www.sentinelone.com/vulnerability-database/cve-2024-6241/ https://www.cve.org/CVERecord?id=CVE-2024-6241 https://nvd.nist.gov/vuln/detail/CVE-2024-6241 https://github.com/advisories/GHSA-2jrf-mm4v-jgmc https://www.sans.org/newsletters/at-risk/xxiv-26
Related VulnerabilitiesPoCCVE-2026-2113: tpadmin <= 1.3.12 - Remote Code ExecutionPoCnacos-v3-auth-scope-bypass: Nacos 3.x - Unauthenticated Admin TakeoverPoCCVE-2026-19598: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX RouterPoCCVE-2026-55224: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCEPoCCVE-2025-13342: DynamiApps Frontend Admin <= 3.28.20 - Unauthenticated Arbitrary Options UpdatePoCCVE-2026-34976: Dgraph <=v25.3.0 - Admin Mutation Missing AuthorizationPoCCVE-2026-45332: Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash DisclosureCisco ISE /admin/files-upload/ 文件上传漏洞(CVE-2025-20282)PoCCVE-2026-8732: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account CreationPoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞PoCNginxWebUI /Adminpage/Conf/loadOrg 文件读取漏洞NginxWebUI /Adminpage/Remote/cmdOver 命令执行漏洞MasterStudy LMS /wp-admin/admin-ajax.php?action=stm_lms_load_content 文件包含漏洞(CVE-2024-3136)