We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2024-58284

CVE-2024-58284

PHP

Severity: HIGH
CVSS: 7.2CVSS
Published: 2025-12-10
Last modified: 2025-12-19
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-94

Description

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

References

https://github.com/PopojiCMS/PopojiCMS
https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
https://www.exploit-db.com/exploits/52022
https://www.popojicms.org/
https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings

Summary

Description

References