CVE-2024-0425 is a medium severity weak password recovery vulnerability in ForU CMS project ForU CMS up to 2020-06-23, scored CVSS 5.3. It affects /admin/index.php?act=reset_admin_psw through the administrator password reset action. The record names no fixed version, so check the vendor or project and restrict access.
What's affected
The record names ForU CMS project ForU CMS, up to 2020-06-23. The weakness is a weak password recovery mechanism: the reset path is easier to abuse than the login it replaces. The weakness is tracked as CWE-640. The affected code is /admin/index.php?act=reset_admin_psw, reached through the administrator password reset action. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-11 and the VulDB identifier is 250444.
The record links a researcher's write up, but we could not read it in usable form, and the VulDB entry is behind a bot check, so we cannot add details beyond the record.
The record does not name a fixed version. Treat the product as unpatched until the vendor or project says otherwise. It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
How to check if you're exposed
Check whether the product runs on a site you control. ForU CMS is a small PHP project, so look for deployed copies, not packages:
find /var/www -name "index.php" -path "*admin*"
Then review how the reset action works in your copy: what proves that the person asking is the administrator, and what changes when it runs. Compare the administrator account details with what you expect, and check for password changes you did not make.
Review your access logs for requests to the reset action from addresses you do not know.
A dependency scanner will not find a standalone application like this on its own, because it is deployed code, not a package. You can still use Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan on any project that bundles it as a library, and the Gold entry for CVE-2024-0425 tracks the record as it changes.
What to do now
- Find every deployed copy of ForU CMS.
- Check the project page for a fixed release. The record lists versions up to 2020-06-23 and we could not confirm a fix.
- Restrict the admin area to a VPN or allow list so the reset action is not reachable from the internet.
- Reset the administrator password through a trusted path and use a long, unique one.
- Review the administrator account for changes you did not make.
- If the software is not essential, retire it and move to a maintained CMS.
Why it matters
Password recovery is a second door to the same room, and it has to be at least as hard to open as the first. When the reset action can be abused, an attacker can take over the administrator account without knowing the password.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, scored 5.3 (medium). VulDB's wording calls the issue critical, which is its own classification and differs from the CVSS rating. Both are reported here.
This record is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0425 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list and the sources we could read do not report exploitation. The description says a public exploit exists, so do not wait for confirmation.
Is there a fixed version of ForU CMS?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0425
- NVD record for CVE-2024-0425, including VulDB entry 250444, as summarized in the Safeguard record file. We could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed.
Last reviewed: 19 October 2026.
