CVE-2024-10505: Wuzhicms Code Injection RCE Vulnerability

CVE-2024-10505 Overview

CVE-2024-10505 is a code injection vulnerability in wuzhicms 4.1.0, an open-source content management system. The flaw exists in the add/edit functions of www/coreframe/app/content/admin/block.php. Attackers can inject code remotely through the affected functions, mapped to CWE-94 (Improper Control of Generation of Code). The exploit details have been publicly disclosed. The vendor was contacted prior to public disclosure but did not respond. Authenticated attackers with low privileges can exploit this weakness over the network to compromise confidentiality, integrity, and availability of the affected instance.

Critical Impact
Authenticated remote attackers can inject arbitrary code into the block management component of wuzhicms 4.1.0, potentially leading to unauthorized modification of application logic and data.

Affected Products

wuzhicms 4.1.0
Component: www/coreframe/app/content/admin/block.php
Affected functions: add and edit

Discovery Timeline

2024-10-30 - CVE-2024-10505 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10505

Vulnerability Analysis

The vulnerability resides in the block management module of wuzhicms 4.1.0. The add and edit functions within www/coreframe/app/content/admin/block.php process user-supplied input without sufficient validation or sanitization before it reaches a code evaluation context. This category of flaw is classified under CWE-94, improper control of generation of code. According to the disclosure, the researcher initially filed two separate issues corresponding to distinct function calls, both traced back to the same block handler. Because the affected pages sit inside the administrative interface, exploitation requires an authenticated session with block management access.

Root Cause

The root cause is unsafe handling of block content parameters that are later interpreted as executable code. When an administrator submits crafted values through the add or edit workflow, wuzhicms concatenates or stores those values in a way that allows them to be evaluated as PHP code during subsequent rendering. The absence of allow-list input filtering and output encoding permits an attacker to escape the intended data context.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker with access to the administrative block management pages submits a crafted request to the vulnerable add or edit endpoint. The injected payload is stored by the application and executed when the block is processed. No user interaction beyond the attacker's authenticated request is required. Public disclosure of the technique increases the likelihood of opportunistic exploitation against exposed installations.

For technical details on the vulnerable code paths, see the GitHub Issue #209 and the VulDB entry.

Detection Methods for CVE-2024-10505

Indicators of Compromise

Unexpected POST requests to administrative endpoints resolving to www/coreframe/app/content/admin/block.php with do=add or do=edit parameters.
Block records in the wuzhicms database containing PHP tags, backticks, or suspicious function names such as eval, system, passthru, or assert.
New or modified PHP files under the web root that were not deployed through the standard release process.
Outbound network connections from the web server to unfamiliar destinations shortly after administrative block edits.

Detection Strategies

Inspect web server access logs for POST requests targeting the block management module and correlate them with authenticated admin sessions.
Deploy web application firewall (WAF) rules to identify PHP metacharacters and language constructs submitted to block content fields.
Perform integrity monitoring on the wuzhicms application directory to catch unauthorized file creation or modification.

Monitoring Recommendations

Alert on administrative account logins from unusual source IP addresses or geographies.
Track process creation events on the web server host to detect PHP spawning shells, curl, wget, or scripting interpreters.
Forward web server, PHP-FPM, and host telemetry to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2024-10505

Immediate Actions Required

Restrict access to the wuzhicms administrative interface using network ACLs, VPN, or IP allow-listing until a patch is available.
Rotate credentials for all administrative accounts and enforce multi-factor authentication on any upstream identity provider.
Audit existing block records in the database and remove entries containing PHP code constructs.
Review web server file systems for unauthorized PHP files introduced through the vulnerable workflow.

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch is referenced. The vendor did not respond to the researcher's disclosure attempts. Organizations running wuzhicms 4.1.0 should monitor the project's GitHub repository for future fixes and evaluate migration to an actively maintained CMS if updates remain unavailable.

Workarounds

Disable the block add and edit functionality by removing or restricting access to www/coreframe/app/content/admin/block.php at the web server level.
Apply a virtual patch through a WAF that blocks PHP tags and dangerous keywords in POST bodies destined for the block module.
Limit administrative role assignments to a minimal set of trusted users to reduce the exploitable surface.

bash

# Example nginx location block restricting access to the vulnerable script
location ~ ^/coreframe/app/content/admin/block\.php$ {
    allow 10.0.0.0/8;
    deny all;
}