CVE-2024-28187 - CVE House
Back to Database
Status published High CVE-2024-28187

OS Command Injection Vulnerability in SOY CMS

Vulnerability Description

SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 are vulnerable to an OS Command Injection vulnerability within the file upload feature when accessed by an administrator. The vulnerability enables the execution of arbitrary OS commands through specially crafted file names containing a semicolon, affecting the jpegoptim functionality. This vulnerability has been patched in version 3.14.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28187

Credits & Attribution

No credits recorded in the NVD database.

References

More from inunosinsi

View All →
CVE-2020-15189
Remote Code Execution in SOY CMS
Medium 6.8
CVE-2020-15188
Unauthenticated Remote Code Execution in SOY CMS
Critical 10
CVE-2020-15183
Reflected XSS leading to RCE in SoyCMS
High 8.4
CVE-2020-15182
Cross-site Request Forgery leading to RCE in SOY CMS
High 8.4

Affected Vendor

Affected Software

soycms
Vulnerable Versions:
< 3.14.2

Timeline

Official Publish: March 11th, 2024
Last Modified: August 27th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration