Vulnerability · Published Dec 9, 2024 · Assigned by VulDB

CVE-2024-12350JFinalCMS Template TemplateController.java update command injection

Medium 6.3

In plain English

A medium-severity command injection in JFinalCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)3.7%top 10.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
n/a	JFinalCMS	1.0

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-287270 | JFinalCMS Template TemplateController.java update command injection vdb-entry, technical-description
VDB-287270 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #456047 | jwillber JFinalCMS TemplateController.java content 1 Command Injection third-party-advisory
https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Server_Side%20_Template_Injection/Server-Side-Template-Injection.md exploit