What’s Vulnerable › Vulnerabilities

CVE-2024-9278: HuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-27 · updated 2026-06-17
• Weakness: CWE-434

Description

A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The manipulation of the argument domain_verification_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products

• HuankeMao SCRM: from 0.0.1 through 0.0.3

References

• https://vuldb.com/?ctiid.278660
• https://vuldb.com/?id.278660
• https://vuldb.com/?submit.410393
• https://wiki.shikangsi.com/post/share/96b7d919-1749-4e2b-bda2-b80d2fd23865

Get alerted when CVE-2024-9278 or the next vulnerability affects your stack