CVE-2024-58295
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elkarte | forum | 1.1.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in ElkArte Forum 1.1.9 allows authenticated administrators to upload malicious PHP files via the theme installation process. Specifically, an attacker can upload a ZIP archive containing a PHP file with system commands. Once uploaded to the theme directory, these commands can be executed remotely, leading to remote code execution on the server.
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution on the server hosting the ElkArte Forum. This means an attacker with administrator access can execute arbitrary system commands, potentially taking full control of the server, compromising data, disrupting services, or using the server for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for unauthorized PHP files in the theme installation directories of ElkArte Forum 1.1.9. You can search for recently added or modified PHP files in the theme directories. For example, use commands like: find /path/to/elkarte/themes/ -name '*.php' -mtime -7 to find PHP files modified in the last 7 days. Additionally, monitoring web server logs for unusual access patterns to theme directories or suspicious file uploads may help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting theme installation permissions to trusted administrators only, disabling theme uploads if not necessary, and applying any available patches or updates from ElkArte Forum. Additionally, scanning and removing any unauthorized PHP files in theme directories and monitoring for suspicious activity can help reduce risk.