CVE-2024-31008

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the index.php file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
wuzhicms	wuzhicms	4.1.0

References

https://github.com/majic-banana/vulnerability/blob/main/POC/WUZHICMS4.1.0-Captcha%20bypass%20%28logic%20vulnerability%29.mdExploit, Third Party Advisory
https://github.com/majic-banana/vulnerability/blob/main/POC/WUZHICMS4.1.0-Captcha%20bypass%20%28logic%20vulnerability%29.mdExploit, Third Party Advisory

Timeline

Published: Apr 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-310096.5SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.CVE-2024-31017.2In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-Use CVE-2024-310107.5SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.CVE-2024-310119.8Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolate CVE-2024-310129.8An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive inform CVE-2024-310136.1Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to CVE-2024-31025.3A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the CVE-2024-310229.8An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component.CVE-2024-310257.5SQL Injection vulnerability in ECshop 4.x allows an attacker to obtain sensitive information via the file/article.php component.CVE-2024-310269.8An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat i CVE-2024-310275.4Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arb CVE-2024-310298.2An issue in the server_handle_regular function of the test_coap_server.c file within the FreeCoAP project allows remote attackers to cause a