CVE-2024-44724: AutoCMS PHP Code Injection Vulnerability

CVE-2024-44724 Overview

CVE-2024-44724 is a PHP code injection vulnerability in AutoCMS v5.4. The flaw exists in the /admin/site_add.php endpoint and is reachable through the txtsite_url parameter. Attackers who supply a crafted value can execute arbitrary PHP code in the context of the web server. The vulnerability is classified under [CWE-94] (Improper Control of Generation of Code) and affects the confidentiality, integrity, and availability of the host application. Exploitation requires high privileges on the admin interface but no user interaction, and the attack is delivered over the network.

Critical Impact
Authenticated attackers can achieve arbitrary PHP code execution on AutoCMS v5.4 servers by injecting payloads into the txtsite_url parameter of /admin/site_add.php.

Affected Products

AutoCMS v5.4
Deployments using autocms_project:autocms 5.4 CPE
Any web server hosting the vulnerable /admin/site_add.php handler

Discovery Timeline

2024-09-09 - CVE-2024-44724 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44724

Vulnerability Analysis

AutoCMS v5.4 fails to validate or sanitize input passed to the txtsite_url parameter of the administrative endpoint /admin/site_add.php. The application incorporates the attacker-supplied value into a code path that is later evaluated by the PHP interpreter, resulting in code injection. Because the injected content is executed by the PHP runtime, attackers gain the ability to run arbitrary commands under the privileges of the web server process. That capability commonly translates into file read and write access, database manipulation, and lateral movement into adjoining systems.

Root Cause

The root cause is unsafe handling of user-controlled input written to a PHP file or passed to a dynamic evaluation construct such as eval(), include, or preg_replace with the /e modifier. The txtsite_url field is intended to accept a site URL but is not restricted to a URL grammar. AutoCMS neither validates the input against a whitelist nor escapes the value before it is emitted into executable PHP context.

Attack Vector

An authenticated administrator submits a crafted POST request to /admin/site_add.php containing a malicious txtsite_url value. The payload closes any surrounding string context and appends PHP directives that the interpreter executes on subsequent requests or during processing of the site add operation. Successful exploitation yields arbitrary PHP execution and, by extension, operating system command execution when functions such as system or exec are reachable. See the GitHub Issue Report for a reproduction walkthrough.

Detection Methods for CVE-2024-44724

Indicators of Compromise

Unexpected POST requests to /admin/site_add.php containing PHP tokens such as <?php, system(, passthru(, or base64_decode( in the txtsite_url parameter
Newly created or modified .php files under the AutoCMS installation directory, particularly configuration files written by the site add workflow
Web server processes spawning shell interpreters (sh, bash, cmd.exe) or reconnaissance binaries (whoami, id, uname)

Detection Strategies

Inspect web server access and application logs for txtsite_url values that contain PHP syntax, backticks, or URL-encoded angle brackets (%3C%3F)
Monitor for outbound network connections initiated by the PHP-FPM or Apache worker processes hosting AutoCMS
Alert on file integrity changes to AutoCMS files that persist site configuration data

Monitoring Recommendations

Enable verbose logging on the admin interface and forward logs to a central SIEM for correlation
Track authentication events for AutoCMS administrator accounts and flag logins from unusual source addresses
Baseline normal /admin/site_add.php request bodies so that anomalous payloads are surfaced quickly

How to Mitigate CVE-2024-44724

Immediate Actions Required

Restrict access to /admin/* endpoints to trusted management networks or via VPN and IP allowlists
Rotate credentials for all AutoCMS administrator accounts and enforce strong, unique passwords
Audit the AutoCMS installation for unauthorized PHP files, scheduled tasks, or modified templates that may indicate prior exploitation

Patch Information

No vendor advisory or fixed release has been published in the referenced sources at the time of writing. Operators should track the GitHub Issue Report and the AutoCMS project for a security update. Until a patch is available, treat AutoCMS v5.4 deployments as vulnerable and apply compensating controls.

Workarounds

Place a web application firewall in front of AutoCMS and block requests to /admin/site_add.php that contain PHP tags, backticks, or shell metacharacters in txtsite_url
Configure the PHP runtime to disable dangerous functions such as eval, system, exec, passthru, and shell_exec via the disable_functions directive in php.ini
Run the web server as a low-privileged account and apply mandatory access controls to the AutoCMS document root to limit post-exploitation impact

bash

# Configuration example: harden php.ini and block risky payloads at the WAF
# /etc/php/php.ini
disable_functions = eval,exec,system,passthru,shell_exec,proc_open,popen
allow_url_include = Off
allow_url_fopen = Off

# Example ModSecurity rule to block PHP tags in txtsite_url
SecRule ARGS:txtsite_url "@rx (?i)(<\?php|<\?=|`|\$\{)" \
    "id:1004472,phase:2,deny,status:403,msg:'AutoCMS CVE-2024-44724 payload blocked'"