Cyber Resilience

CVE-2024-13264

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
27 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 53.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13264 is a critical-severity Static Code Injection (CWE-96) vulnerability in Opigno Opigno Module. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13264 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, classified as Static Code Injection (CWE-96), in the Drupal Opigno module. This flaw enables PHP Local File Inclusion and affects all versions of the Opigno module from 0.0.0 before 3.1.2.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Remote attackers with no authentication or privileges required can exploit it over the network with low attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability through PHP Local File Inclusion, potentially leading to arbitrary code execution.

The Drupal Security Advisory SA-CONTRIB-2024-028 at https://www.drupal.org/sa-contrib-2024-028 provides details on mitigation, including patching to Opigno module version 3.1.2 or later.

EU & UK References

Vulnerability details

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

CWE(s)
CWE-96

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Vulnerability in Drupal Opigno module enables arbitrary PHP code execution via insufficient uploaded file validation, facilitating exploitation of public-facing web applications and deployment/execution of web shells.

CVEs Like This One

CVE-2024-13265Same vendor: Opigno
CVE-2024-13267Same vendor: Opigno
CVE-2025-57707Shared CWE-96

Affected Assets

opigno
opigno module
≤ 3.1.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the CVE by requiring timely patching of the vulnerable Opigno module to version 3.1.2 or later as specified in the Drupal security advisory.

SI-10 Information Input Validation good match
prevent

Prevents static code injection by enforcing validation and neutralization of directives in user inputs before they are saved and executed as code in the Drupal module.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Detects unauthorized code modifications or injections resulting from the PHP Local File Inclusion vulnerability through software integrity monitoring.

References