Vulnerability record · CVE-2024-9916 · published 13 October 2024
CVE-2024-9916: HuangDou UTCMS cli.php argument o OS command injection
UUsualtool · Usualtoolcms
HuangDou UTCMS V9 contains an OS command injection flaw in app/modules/ut-cac/admin/cli.php, where manipulation of the argument o allows arbitrary command execution. The vulnerability is remotely reachable and a public exploit has been disclosed, while the vendor did not respond to the report.
Description
A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Automated analysis
high priorityRemote unauthenticated OS command injection with a public exploit and very high EPSS score, though CVSS 4.0 rates it medium due to limited scope.
What it is
HuangDou UTCMS V9 contains an OS command injection flaw in app/modules/ut-cac/admin/cli.php, where manipulation of the argument o allows arbitrary command execution. The vulnerability is remotely reachable and a public exploit has been disclosed, while the vendor did not respond to the report.
Impact
An attacker can execute arbitrary operating system commands on the server, potentially leading to full compromise of the host and any data or services it hosts.
Attack surface
The flaw is reachable over the network via the cli.php endpoint with no authentication or user interaction required per the CVSS 4.0 vector (AV:N/PR:N/UI:N).
Exploitation
A public exploit is referenced (Exploit tag) and EPSS is 0.73617 (99.4th percentile), indicating high likelihood of exploitation; it is not listed in CISA KEV.
What to do
- Apply the vendor patch if one becomes available; the vendor did not respond, so check for updates from HuangDou/usualtool.
- Restrict network access to app/modules/ut-cac/admin/cli.php and the admin interface to trusted IPs only.
- Disable or remove the ut-cac module if it is not required.
- Run the web application with least privilege and in a sandboxed environment to limit command execution impact.
- Monitor for and block suspicious command injection patterns targeting the o parameter.
Detection
- Inspect web server and application logs for requests to app/modules/ut-cac/admin/cli.php with unusual o parameter values.
- Monitor process creation on the host for unexpected child processes spawned by the web server user.
- Use WAF or IDS rules to detect command injection payloads in HTTP requests to cli.php.
- Alert on outbound network connections from the web server to unusual destinations that may indicate post-exploitation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/DeepMountains/zzz/blob/main/CVE5-1.md | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.280244 | Permissions Required |
| https://vuldb.com/?id.280244 | Third Party Advisory |
| https://vuldb.com/?submit.418748 | Third Party Advisory |
Track CVE-2024-9916 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-9916), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
