Vulnerabilities

CVE-2024-9916 is a critical operating system command injection flaw (CWE-78) in HuangDou UTCMS V9 (also distributed as UsualToolCMS), located in the file app/modules/ut-cac/admin/cli.php. An attacker triggers it by sending crafted input in the 'o' argument of that endpoint, causing injected commands to run on the host; the CVSS vector (network attack vector, no privileges required, no user interaction) indicates the attack can be launched remotely without authentication. Successful exploitation yields execution of arbitrary operating system commands on the web server, typically giving an attacker control of the host and access to its data. Any internet-reachable deployment of UTCMS V9/UsualToolCMS is potentially affected. A proof-of-concept exploit has been published publicly, the vendor was notified but did not respond, no fixed version is documented, and the flaw is not yet in CISA's KEV catalog, though its EPSS score of 73.6% (99th percentile) signals a high likelihood of exploitation in the next 30 days.

Do: No vendor patch is available (the vendor was contacted but did not respond), so mitigate by restricting access to app/modules/ut-cac/admin/cli.php and enforcing strict validation or an allowlist on the 'o' parameter, including WAF rules that block shell metacharacters in that argument. Review web access logs for requests to that endpoint with command metacharacters in 'o', and watch for a vendor advisory or updated release before applying any full upgrade.

An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file.

An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.

UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.