Jizhicms CVE-2024-32161

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-04-17 cve@mitre.org

File Upload Jizhicms

9.8

CVSS 3.1 · Vendor: mitre

Share

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Apr 17, 2024 - 18:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

jizhiCMS 2.5 suffers from a File upload vulnerability.

AnalysisAI

jizhiCMS 2.5 suffers from a File upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Affected products include: Jizhicms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Jizhicms

View all

CVE-2025-25784 CRITICAL Act Now POC

An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to

CVE-2023-51154 CRITICAL Act Now POC

Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsContr

CVE-2023-2927 CRITICAL Act Now POC

A vulnerability was found in JIZHICMS 2.4.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita

CVE-2022-36578 CRITICAL Act Now POC

jizhicms v2.3.1 has SQL injection in the background. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2022-27429 CRITICAL Act Now POC

Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/upda

CVE-2022-31393 CRITICAL Act Now POC

Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in a

CVE-2022-31390 CRITICAL Act Now POC

Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in

CVE-2020-37117 HIGH This Week POC

Jizhicms versions up to 1.6.7 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

CVE-2023-50692 HIGH This Week POC

File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploade

CVE-2022-45278 HIGH This Week POC

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html

CVE-2022-44140 HIGH This Week POC

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. Rated

CVE-2022-36577 HIGH This Week POC

An issue was discovered in jizhicms v2.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2020-36847 CRITICAL POC

CVE-2017-6090 HIGH POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2024-5084 CRITICAL POC

CVE-2016-6600 CRITICAL POC

CVE-2017-6090 HIGH POC

CVE-2015-8249 CRITICAL POC

Share

CVE-2024-32161 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy