CVE-2020-24036

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-04 · updated 2026-07-09
Weakness: CWE-502

Description

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.

Affected products

forkcms/forkcms: before 5.8.3 — fixed in 5.8.3

How to fix

Upgrade to a fixed version: forkcms/forkcms 5.8.3. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/161764/ForkCMS-PHP-Object-Injection.html
http://seclists.org/fulldisclosure/2021/Mar/31
https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04
http://seclists.org/fulldisclosure/2021/Mar/31
https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04

Get alerted when CVE-2020-24036 or the next vulnerability affects your stack