CVE-2024-0416 is a medium severity path traversal vulnerability in DeShang DSMall up to 5.0.3, scored CVSS 5.4. It affects application/home/controller/MemberAuth.php through the file_name argument. The record names no fixed version, so check the vendor or project and restrict access.
What's affected
The record names DeShang DSMall, up to 5.0.3. The weakness is path traversal, where a file name supplied by a user is used in a way that can point outside the intended folder. The weakness is tracked as CWE-24. The affected code is application/home/controller/MemberAuth.php, reached through the file_name argument. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-11 and the VulDB identifier is 250436.
The record links a researcher's write up, but we could not read it in usable form, and the VulDB entry is behind a bot check, so we cannot add details beyond the record.
The record does not name a fixed version. Treat the product as unpatched until the vendor or project says otherwise. It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
How to check if you're exposed
Find the controller in your copy:
find /var/www -name "MemberAuth.php"
Read how it handles the file_name argument. The pattern to look for is a user supplied name joined to a base folder with no check that the resolved path stays inside it.
Review the logs for requests to this controller with dot dot sequences or encoded forms in the parameter. Also check file permissions for the web server account, since the reach of a traversal bug is the set of files that account can read or write.
A dependency scanner will not find a standalone application like this on its own, because it is deployed code, not a package. You can still use Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan on any project that bundles it as a library, and the Gold entry for CVE-2024-0416 tracks the record as it changes.
What to do now
- Find every deployed copy of DSMall.
- Check the vendor or project page for a fixed release. We could not confirm one.
- In the controller, resolve the final path and refuse it if it falls outside the intended folder.
- Use generated file names instead of names supplied by users.
- Run the web server account with write access only to the folders it needs.
- Review the logs for requests with dot dot patterns in the parameter, and for files that appeared where they should not.
Why it matters
Path traversal is about trust in a name. A file name from a user is used to build a path, and sequences that move up a folder can carry it out of the intended place.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, scored 5.4 (medium). VulDB's description calls it critical, which is its own label. The CVSS score is lower because the vector reflects limited impact and a need for a low privilege account.
This record is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0416 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list and the sources we could read do not report exploitation. The description says a public exploit exists, so do not wait for confirmation.
Is there a fixed version of DSMall?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0416
- NVD record for CVE-2024-0416, including VulDB entry 250436, as summarized in the Safeguard record file. We could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed.
Last reviewed: 19 October 2026.
