CVE-2024-58284

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-58284

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58284.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-58284

Published

2025-12-10T21:15:07.958Z

Modified

2026-07-15T01:49:17.717184410Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

Details

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58284.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/popojicms/popojicms

Affected ranges

Type

GIT

Repo

https://github.com/popojicms/popojicms

Events

Introduced

07c36e2c8f2ecf27015d838d607db692385b53da

Last affected

07c36e2c8f2ecf27015d838d607db692385b53da

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.1"
        },
        {
            "last_affected": "2.0.1"
        }
    ],
    "cpe": "cpe:2.3:a:popojicms:popojicms:2.0.1:*:*:*:*:*:*:*"
}

Affected versions

2.*

2.0.1

v2.*

v2.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58284.json"