CVE-2024-2015

Summary

CVE-2024-2015 is a critical vulnerability affecting ZhiCms 4.0. The issue lies in the getindexdata function of the mcontroller.php file in the app/index/controller directory. An attacker can manipulate the argument key to execute SQL injection attacks, which may be initiated remotely. The exploit for this vulnerability has been disclosed to the public, increasing the risk of exploitation. The Vulnerability Database has assigned the identifier VDB-255269 to this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.