CVE-2024-12789 PbootCMS IndexController.php code injection

What is CVE-2024-12789?

CVE-2024-12789 is a medium-severity vulnerability in PbootCMS, published on 19 Dec 2024.

Official description

A vulnerability was found in PbootCMS up to 3.2.3. It has been classified as critical. This affects an unknown part of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.4 is able to address this issue. It is recommended to upgrade the affected component.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2024-12789?

It affects 1 product.

Products include Pbootcms Pbootcms.

How do I fix CVE-2024-12789?

No fix has been published for CVE-2024-12789 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-12789 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12789 exists.

Other vulnerabilities in PbootCMS

• CVE-2023-39834 Command injection in n/a Critical 9.8
• CVE-2021-37497 SQL injection in n/a Critical 9.8
• CVE-2022-32417 Code injection in n/a Critical 9.8
• CVE-2020-23580 Code injection in n/a Critical 9.8
• CVE-2018-16356 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-57cm-p9q8-qfqp.