Description
A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dayrui | XunRuiCMS | 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4 | — |
References
- VDB-295090 | dayrui XunRuiCMS Api.php deserialization vdb-entry technical-description
- VDB-295090 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #495820 | 四川迅睿云软件开发有限公司 迅睿CMS <=4.6.4 (2024-12-17) Remote Code Execute third-party-advisory
- https://github.com/pwysec/d6qRhl/blob/main/1.pdf broken-link exploit