CVE-2024-0728 is a medium severity flaw in ForU CMS up to the 2020-06-23 version, scored 4.7 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists ForU CMS up to the 2020-06-23 version as affected. The record says the c_cmodel argument in channel.php leads to file inclusion and that the attack can be launched remotely. It rates the privileges required as high. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The weaknesses are CWE-73 and CWE-610.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Find ForU CMS installs on your web servers and check the release date in the project files. Anything up to 2020-06-23 is in scope. Review web server logs for requests to channel.php with unusual c_cmodel values.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
File inclusion flaws let a request influence which file a server side script loads. If the path is not constrained, the script may read or run a file it should not. The weaknesses recorded are CWE-73 (external control of file name or path) and CWE-610 (externally controlled reference to a resource).
The score is medium partly because the record requires high privileges, so an administrator level account is the starting point. That limits casual abuse but does not help if admin credentials are weak or reused. The product dates from 2020 and a sibling CVE, CVE-2024-0729, affects the same CMS, which suggests the whole product deserves a review or retirement.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Do I need admin rights?
The record rates privileges required as high.
Is there a related CVE?
Yes, CVE-2024-0729 is a SQL injection in cms_admin.php of the same product.
Sources
Last reviewed: 19 October 2026.
