{"id":"CVE-2024-12900","state":"PUBLISHED","title":"FoxCMS Configuration File installdb.php code injection","description":"A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2024-12-23T01:31:05.891Z","updatedAt":"2024-12-24T02:05:11.393Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["n/a FoxCMS"],"affected":[{"vendor":"n/a","product":"FoxCMS","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"}],"modules":["Configuration File Handler"]}],"references":["https://vuldb.com/?id.289170","https://vuldb.com/?ctiid.289170","https://vuldb.com/?submit.467658","https://note.zhaoj.in/share/iDCwOv9vfDTI"],"weaknesses":["CWE-94","CWE-74"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12900.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12900","state":"PUBLISHED","datePublished":"2024-12-23T01:31:05.891Z","dateUpdated":"2024-12-24T02:05:11.393Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-12-22T16:47:38.979Z"},"containers":{"cna":{"title":"FoxCMS Configuration File installdb.php code injection","descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in FoxCMS bis 1.2 entdeckt. Es betrifft eine unbekannte Funktion der Datei /install/installdb.php der Komponente Configuration File Handler. Mit der Manipulation des Arguments database password mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"n/a","product":"FoxCMS","versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"}],"modules":["Configuration File Handler"]}],"references":[{"url":"https://vuldb.com/?id.289170","name":"VDB-289170 | FoxCMS Configuration File installdb.php code injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.289170","name":"VDB-289170 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.467658","name":"Submit #467658 | FoxCMS <=1.2 Config injection","tags":["third-party-advisory"]},{"url":"https://note.zhaoj.in/share/iDCwOv9vfDTI","tags":["broken-link","exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-12-23T01:31:05.891Z"},"timeline":[{"time":"2024-12-22T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-12-22T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-12-22T17:52:49.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"glzjin (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-24T02:04:36.358260Z","id":"CVE-2024-12900","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-24T02:05:11.393Z"}}]}}}