CVE-2024-28187 OS Command Injection Vulnerability in SOY CMS
An administrator can execute arbitrary OS commands via crafted file names in the file upload feature of SOY CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28187?
CVE-2024-28187 is a high-severity command injection vulnerability in inunosinsi soycms, published on 11 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2024-28187?
It affects 1 product.
Products include Saitodev Soy Cms.
How do I fix CVE-2024-28187?
No fix has been published for CVE-2024-28187 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-28187 being exploited?
There is no known exploitation of CVE-2024-28187 in the wild and no public exploit code.
Sources
Also known as GHSA-qg3q-hfgc-5jmm.