Cyber Posture

CVE-2024-13264

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
27 August 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2024-13264 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, classified as Static Code Injection (CWE-96), in the Drupal Opigno module. This flaw enables PHP Local File Inclusion and affects all versions of the Opigno module from 0.0.0 before 3.1.2.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Remote attackers with no authentication or privileges required can exploit it over the network with low attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability through PHP Local File Inclusion, potentially leading to arbitrary code execution.

The Drupal Security Advisory SA-CONTRIB-2024-028 at https://www.drupal.org/sa-contrib-2024-028 provides details on mitigation, including patching to Opigno module version 3.1.2 or later.

Details

CWE(s)
CWE-96

Affected Products

opigno
opigno module
≤ 3.1.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Vulnerability in Drupal Opigno module enables arbitrary PHP code execution via insufficient uploaded file validation, facilitating exploitation of public-facing web applications and deployment/execution of web shells.

References