CVE-2024-1353 is a medium severity deserialization flaw in PHPEMS, an online exam system, up to version 1.0, in the weixin controller. NVD scores it 6.3 and the record says exploit details are public. No fix is confirmed, so restrict access.
What's affected
The record names PHPEMS, up to version 1.0. The weak spot is the file app/weixin/controller/index.api.php, with the picurl argument. The remote attack path and the public disclosure both come from the VulDB entry, number 253226, which the record paraphrases.
NVD scores it 6.3, which is Medium. The vector shows adjacent network access and no privileges, which explains the 6.3 score.
No fixed version is stated in the record. Treat every PHPEMS version up to 1.0 as affected and check the project for a newer release.
Weakness class: CWE-502. The NVD record carries the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L and a score of 6.3.
How to check if you're exposed
Look at the file named in the record, the file app/weixin/controller/index.api.php, and see how it handles the picurl value. Search web logs for requests to that path with unusual values in that parameter.
If you are not sure whether the product is installed, search your server inventory and application list for its name, since small business software like this often sits on a single forgotten host.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every installation of PHPEMS and record the version.
- Ask the vendor for a patched release and apply it as soon as it is available.
- Until a fix exists, limit who can reach the application, for example by placing it behind a VPN or an allow list, and block public access to the file app/weixin/controller/index.api.php.
- Watch web server logs for requests to the affected route and for new or changed files.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
Deserialization of untrusted data (CWE-502) means the picurl input is turned back into program objects without enough checks. If an attacker influences what gets rebuilt, code that runs during the rebuild can be steered.
The record does not describe the exact outcome and I have not tested the product, so treat code execution as a risk to rule out and not as a stated fact. The record does not say the vendor responded.
Quick check
Is CVE-2024-1353 known to be exploited?
The KEV flag in the record is false. The record does say the exploit details have been disclosed publicly, so do not wait for exploitation reports before acting.
Where can I read the original report?
The record cites VulDB entry 253226 and an outside write up. I could not retrieve them, so check them yourself for the proof of concept level detail, which this post leaves out on purpose.
Sources
- NVD record for CVE-2024-1353
- VulDB entry cited in the record (not retrieved)
- Write up cited in the record (not retrieved)
Last reviewed: 19 October 2026.
