CVE-2024-57052

CVE-2024-57052 is a privilege escalation vulnerability affecting youdiancms versions 9.5.20 and earlier. The issue stems from improper handling of the sessionID parameter in the index.php file, enabling remote attackers to escalate their privileges. It is associated with CWE-384 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

Any remote attacker can exploit this vulnerability without authentication, privileges, or user interaction, requiring only network access and low attack complexity. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise through elevated privileges.

A related advisory is documented at https://gist.github.com/yahaha9/720fb45bbebda62dc198568c8d275df8.