CVE-2024-9916

What it actually does

CVE-2024-9916 is a critical remote OS command injection vulnerability in HuangDou UTCMS V9 affecting app/modules/ut-cac/admin/cli.php. User-controlled input passed through the o argument is not safely validated or escaped before being used in an operating system command, allowing a remote attacker to append shell metacharacters and execute arbitrary commands with the privileges of the web server or PHP runtime. Successful exploitation can enable command execution, web shell deployment, credential theft, lateral movement, data tampering, and full compromise of the affected application host.

Why it matters to the business

An internet-exposed HuangDou UTCMS V9 instance can be taken over remotely without reliable user interaction, creating a high risk of service disruption, data theft, website defacement, malware installation, and use of the server as a foothold into broader infrastructure. The exploit is publicly disclosed and assessed as weaponized, with a high EPSS likelihood of exploitation, so organizations running this software should treat exposure as urgent even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker identifies a HuangDou UTCMS V9 deployment and probes for the vulnerable administrative CLI endpoint at app/modules/ut-cac/admin/cli.php. The attacker sends a crafted HTTP request containing the o parameter with injected shell syntax, such as command separators or command substitution characters, causing the server-side PHP code to execute attacker-supplied operating system commands. Initial commands typically confirm execution using id, whoami, uname, curl, wget, nslookup, or ping. After confirming code execution, the attacker may download a web shell, create persistence, enumerate local configuration files and credentials, access databases, modify site content, or use the host for pivoting. Because exploit details are public and weaponized, opportunistic scanning and automated exploitation are likely against internet-facing systems.

How to fix it

Upgrade HuangDou UTCMS V9 to a vendor-provided fixed release if one becomes available. At the time of the supplied vulnerability data, no fixed versions are listed and the vendor reportedly did not respond, so compensating controls are important. Remove or disable access to app/modules/ut-cac/admin/cli.php if it is not strictly required. Restrict administrative paths to trusted IP addresses through a reverse proxy, web server ACL, VPN, or WAF. Add WAF rules blocking requests to cli.php where the o parameter contains shell metacharacters such as ;, |, &, $, `, $(), >, <, newline encodings, curl, wget, bash, sh, nc, python, perl, or php -r. Ensure the web server runs with least privilege, disable dangerous PHP functions where operationally feasible, and monitor for unexpected child processes spawned by the web server. If the application cannot be remediated, isolate it from the internet or replace it with a maintained product.

How to confirm the fix worked

Confirm whether HuangDou UTCMS V9 is deployed and whether app/modules/ut-cac/admin/cli.php is reachable from untrusted networks. Validate remediation by confirming that direct requests to the endpoint are blocked, return 403/404, or are accessible only from authorized management networks. Review web server, reverse proxy, and WAF logs for requests containing cli.php and an o parameter with command-injection metacharacters. Where safe and authorized, use a non-destructive test such as submitting a blocked payload containing a harmless command marker and confirm it is rejected and does not spawn a shell or external network connection. On the host, verify that the web server or PHP process cannot spawn unexpected system utilities in response to HTTP requests. If a vendor update is later released, confirm the installed application version matches or exceeds the fixed version and retest the endpoint behavior.

Typical attack path

1. Scan the internet or known asset ranges for HuangDou UTCMS V9 instances.
2. Request the vulnerable endpoint /app/modules/ut-cac/admin/cli.php or equivalent application path.
3. Submit a crafted o parameter containing shell metacharacters or command-substitution payloads.
4. Verify remote command execution using benign commands such as whoami, id, uname, ping, nslookup, curl, or wget.
5. Retrieve additional payloads such as a PHP web shell, reverse shell, credential harvester, or botnet loader.
6. Read application configuration files, database credentials, session data, or uploaded content.
7. Establish persistence through web shells, cron jobs, modified PHP files, or new administrator accounts where possible.
8. Use the compromised server for data theft, defacement, malware hosting, command-and-control, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review web server access logs, reverse proxy logs, WAF events, EDR telemetry, process creation logs, shell history where available, cron files, recently modified web directories, and outbound network telemetry. Focus on HTTP requests to app/modules/ut-cac/admin/cli.php or cli.php that include the o parameter and contain command separators, encoded metacharacters, or common reconnaissance and downloader commands. Correlate suspicious requests with process execution where the web server user spawned /bin/sh, bash, curl, wget, nc, python, perl, php -r, chmod, chown, crontab, or similar utilities. Look for newly created or modified PHP files in web-accessible directories, especially files with web shell functions such as system, exec, shell_exec, passthru, popen, proc_open, eval, assert, base64_decode, or preg_replace with executable behavior. Investigate outbound connections shortly after suspicious requests, especially to unknown IPs or domains over HTTP, HTTPS, DNS, or unusual high ports. If command execution indicators are found, treat the host as compromised and perform full incident response rather than only deleting suspicious files.

• /app/modules/ut-cac/admin/cli.php
• app/modules/ut-cac/admin/cli.php
• cli.php?o=
• cli.php%3Fo%3D
• GET /app/modules/ut-cac/admin/cli.php
• POST /app/modules/ut-cac/admin/cli.php
• o=whoami
• o=id
• o=uname
• o=cat%20/etc/passwd
• o=cat+/etc/passwd
• o=wget
• o=curl
• o=busybox
• o=nc%20
• o=netcat
• o=bash
• o=sh%20
• o=python
• o=perl
• o=php%20-r
• o=chmod
• o=crontab
• o=nslookup
• o=ping
• o=;
• o=%3B
• o=|
• o=%7C
• o=&
• o=%26
• o=`
• o=%60
• o=$(
• o=%24%28
• /bin/sh -c
• /bin/bash -c
• php-fpm spawned /bin/sh
• apache2 spawned /bin/sh
• httpd spawned /bin/sh
• nginx spawned /bin/sh
• www-data spawned /bin/sh
• system(
• shell_exec(
• passthru(
• proc_open(
• popen(
• base64_decode(

What your security team should do

• Immediately inventory all HuangDou UTCMS V9 deployments, prioritizing internet-facing systems.
• If exposed, block or restrict access to /app/modules/ut-cac/admin/cli.php at the web server, reverse proxy, or WAF layer.
• Because exploit maturity is weaponized and EPSS is high, perform compromise assessment before assuming patching or blocking is sufficient.
• Search historical HTTP logs for requests to cli.php with the o parameter, especially payloads containing shell metacharacters or commands such as curl, wget, bash, sh, nc, python, perl, whoami, id, uname, ping, or nslookup.
• Inspect affected hosts for web shells, recently modified PHP files, suspicious cron entries, unauthorized users, unexpected outbound connections, and web server child processes spawning shells or download utilities.
• Rotate credentials stored on or accessible from any potentially compromised UTCMS server, including database, administrative, API, and SSH credentials.
• Place affected systems behind authenticated access controls or VPN until a trusted fixed version is available.
• Create SIEM and WAF detections for exploitation attempts against app/modules/ut-cac/admin/cli.php and suspicious o parameter values.
• If exploitation is confirmed, preserve logs and disk artifacts, isolate the host, rebuild from known-good media, and conduct incident response scoping for lateral movement.