CVE-2024-58284
📋 TL;DR
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability where administrative users can inject malicious PHP code through metadata settings. This allows attackers with admin credentials to create web shells and execute arbitrary system commands. Only PopojiCMS 2.0.1 installations with admin accounts are affected.
💻 Affected Systems
- PopojiCMS
📦 What is this software?
Popojicms by Popojicms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing data theft, lateral movement, ransomware deployment, and complete system control.
Likely Case
Attackers create persistent web shells to execute commands, steal data, and maintain access for further exploitation.
If Mitigated
Limited impact if strong authentication controls prevent unauthorized admin access and proper input validation is implemented.
🎯 Exploit Status
Exploit requires admin credentials but is straightforward once authenticated. Public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.popojicms.org/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if released or implementing workarounds.
🔧 Temporary Workarounds
Restrict Admin Access
allImplement strong authentication controls and limit admin access to trusted IP addresses only.
Input Validation
allAdd input validation to metadata settings endpoint to prevent PHP code injection.
🧯 If You Can't Patch
- Disable or restrict access to the metadata settings endpoint in web server configuration.
- Implement web application firewall rules to block PHP code injection attempts.
🔍 How to Verify
Check if Vulnerable:
Check if running PopojiCMS version 2.0.1 and review admin access logs for suspicious metadata modifications.Check Version:
Check PopojiCMS configuration files or admin panel for version information.Verify Fix Applied:
Test metadata settings endpoint with PHP code injection attempts to ensure proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual admin login attempts
- Metadata settings modifications containing PHP code
- GET requests with suspicious parameters
Network Indicators:
- HTTP requests to metadata endpoint with PHP code in parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/admin/metadata" OR uri="/metadata") AND (body CONTAINS "<?php" OR body CONTAINS "eval(" OR body CONTAINS "system(")🔗 References
- https://github.com/PopojiCMS/PopojiCMS
- https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
- https://www.exploit-db.com/exploits/52022
- https://www.popojicms.org/
- https://www.vulncheck.com/advisories/popojicms-remote-command-execution-via-authenticated-metadata-settings
- https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip
