CVE-2024-58284 PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings
Administrative users can inject malicious PHP code via metadata settings to execute arbitrary system commands on PopojiCMS installations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58284?
CVE-2024-58284 is a high-severity code injection vulnerability in PopojiCMS, published on 10 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
Weakness: CWE-94
Which versions are affected by CVE-2024-58284?
It affects 1 product.
Products include Popojicms Popojicms.
How do I fix CVE-2024-58284?
No fix has been published for CVE-2024-58284 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-58284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58284 exists.
Other vulnerabilities in PopojiCMS
Sources
Also known as GHSA-jg32-m8mr-6xvg.