CVE-2024-32161
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
JizhiCMS 2.5 suffers from a file upload vulnerability due to insufficient validation. An attacker can upload a malicious file, potentially leading to remote code execution.
Risk Assessment
The risk for the organization includes potential server compromise through malicious file upload, which could lead to data loss or system integrity breach.
Recommendation
It is recommended to immediately update JizhiCMS to the latest version and implement file type validation and size restrictions.
Other vulnerabilities in JizhiCMS
See all- CVE-2025-25785Critical
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability in the component \c\PluginsController.php. This allows attackers to perform intranet scanning via a crafted request.
- CVE-2025-25784Critical
An arbitrary file upload vulnerability in Jizhicms v2.5.4 component TemplateController.php allows attackers to execute arbitrary code by uploading a crafted ZIP file.
- CVE-2025-70397High
In jizhicms 2.5.6, a SQL injection vulnerability was found in the Article/deleteAll and Extmolds/deleteAll functions via the data parameter. An attacker can inject malicious SQL queries, leading to unauthorized database access.
- CVE-2020-21228Medium
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the /user/release.html component, allowing attackers to arbitrarily add an administrator cookie.
Original NVD description (English source)
jizhiCMS 2.5 suffers from a File upload vulnerability.