CVE-2024-56145

🗓️ 18 Dec 2024 20:37:34Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 3617 Views🌐 WEB

Remote code execution in Craft CMS with register_argc_argv enabled; update advised.

Reporter	Title	Published	Views	Family All 32
GithubExploit	Exploit for Code Injection in Craftcms Craft_Cms	20 Dec 202403:34	–	githubexploit
GithubExploit	Exploit for Code Injection in Craftcms Craft_Cms	6 Apr 202510:16	–	githubexploit
GithubExploit	Exploit for Code Injection in Craftcms Craft_Cms	22 Dec 202411:53	–	githubexploit
0day.today	Craft CMS Twig Template Injection / Remote Code Execution Exploit	27 Jan 202500:00	–	zdt
ATTACKERKB	CVE-2024-56145	18 Dec 202400:00	–	attackerkb
Circl	CVE-2024-56145	18 Dec 202422:54	–	circl
CISA KEV Catalog	Craft CMS Code Injection Vulnerability	2 Jun 202500:00	–	cisa_kev
CISA	CISA Adds Five Known Exploited Vulnerabilities to Catalog	2 Jun 202512:00	–	cisa
CNNVD	Craft CMS 代码注入漏洞	18 Dec 202400:00	–	cnnvd
CNVD	Craft CMS Unauthenticated Remote Code Execution Vulnerability	25 Dec 202400:00	–	cnvd

NVD

Vulners

Node

craftcms craft_cmsRange3.0.0–3.9.14

craftcms craft_cmsRange4.0.0–4.13.2

craftcms craft_cmsRange5.0.0–5.5.2

[
  {
    "vendor": "craftcms",
    "product": "cms",
    "versions": [
      {
        "version": ">= 4.0.0-RC1, < 4.13.2",
        "status": "affected"
      },
      {
        "version": ">= 5.0.0-RC1, < 5.5.2",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.9.14",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3
github	www.github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/Chocapikk/CVE-2024-56145

Parameter	Position	Path	Description	CWE
template	query param	/?template=	Twig template injection via the template parameter (Craft CMS 5.0 Twig Injection PoC).	CWE-94
--templatesPath	query param	/?--templatesPath=/	TemplatesPath path traversal/injection test for Craft CMS Twig Injection PoC.	CWE-94