CVE-2024-9916

🗓️ 13 Oct 2024 19:00:07Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 60 Views🌐 WEB

A critical vulnerability in HuangDou UTCMS V9's file app/modules/ut-cac/admin/cli.php allows for remote os command injection via manipulation of the argument o

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-9916	13 Oct 202422:16	–	circl
CNNVD	UTCMS 操作系统命令注入漏洞	13 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9916 HuangDou UTCMS cli.php os command injection	13 Oct 202419:00	–	cvelist
Nuclei	HuangDou UTCMS V9 - OS Command Injection	1 Jun 202605:38	–	nuclei
NVD	CVE-2024-9916	13 Oct 202419:15	–	nvd
Positive Technologies	PT-2024-39933 · Huangdou · Huangdou Utcms	13 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9916	5 Feb 202504:33	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2024-9916	18 Feb 202500:00	–	vulncheck_kev
Vulnrichment	CVE-2024-9916 HuangDou UTCMS cli.php os command injection	13 Oct 202419:00	–	vulnrichment

NVD

Node

usualtool usualtoolcmsMatch9.0

[
  {
    "vendor": "HuangDou",
    "product": "UTCMS",
    "versions": [
      {
        "version": "V9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/DeepMountains/zzz/blob/main/CVE5-1.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
o	query param	app/modules/ut-cac/admin/cli.php	OS command injection via parameter o in the cli.php admin CLI endpoint	CWE-78

16 Oct 2024 22:11Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.3 - 9.8

CVSS 46.9

CVSS 27.5

CVSS 37.3

EPSS0.83567

SSVC

CWE-78