First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-39157

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
idccms_project	idccms	1.35

References

https://github.com/Thirtypenny77/cms2/blob/main/57/csrf.mdExploit, Third Party Advisory
https://github.com/Thirtypenny77/cms2/blob/main/57/csrf.mdExploit, Third Party Advisory

Timeline

Published: Jun 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-391588.8idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet.CVE-2024-39166.4The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions CVE-2024-391626.1pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer CVE-2024-391638.8binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.CVE-2024-391659.8QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload CVE-2024-39176.1The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re CVE-2024-391719.8Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writin CVE-2024-391739.8calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculato CVE-2024-391746.1A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts CVE-2024-391785.4MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uu CVE-2024-39184.8The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users s CVE-2024-391816.5Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenera