Cyber Posture

CVE-2024-13265

High

Published: 09 January 2025

Published
09 January 2025
Modified
27 August 2025
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2024-13265 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, known as 'Static Code Injection' (CWE-96), in the Drupal Opigno Learning path module. This flaw allows PHP Local File Inclusion and affects all versions of Opigno Learning path from 0.0.0 before 3.1.2.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). A low-privileged authenticated user can exploit it remotely over the network, though it requires high attack complexity and no additional user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability.

Drupal's security advisory SA-CONTRIB-2024-029 (https://www.drupal.org/sa-contrib-2024-029) documents the issue, with mitigation achieved by upgrading Opigno Learning path to version 3.1.2 or later.

Details

CWE(s)
CWE-96

Affected Products

opigno
learning path
≤ 3.1.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Vulnerability enables arbitrary PHP code execution via authenticated file upload in Drupal module, exploiting public-facing web application (T1190) and allowing deployment/execution of web shells (T1100, T1505.003).

References