What is CVE-2024-2015?

CVE-2024-2015 is a critical SQL injection vulnerability found in ZhiCms 4.0, specifically in the function getindexdata of the file app/index/controller/mcontroller.php. Although the exact types of systems affected are not mentioned, it's important to be aware of this vulnerability and take necessary precautions to protect your systems.

Who is impacted by CVE-2024-2015?

This issue is a SQL injection vulnerability that can impact the security and stability of your system. It's important to know that only version 4.0 of ZhiCms is affected by this vulnerability. Stay informed and take necessary precautions to protect your systems.

What should I do if I’m affected?

If you're affected by the CVE-2024-2015 vulnerability, it's crucial to take action to protect your system. Unfortunately, specific mitigation steps are not provided in the available sources. As a general precaution, consider replacing the affected object with an alternative product.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-2015 vulnerability in ZhiCms 4.0 is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-89, which is an SQL injection issue in ZhiCms 4.0's getindexdata function.

Learn More

CVE-2024-2015 is a critical SQL injection vulnerability in ZhiCms 4.0 that can impact the confidentiality, integrity, and availability of affected systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• VulDB Entry on CVE-2024-2015