CVE-2024-1577
Remote Code Execution in MegaBIP
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.
La vulnerabilidad de ejecución remota de código en el software MegaBIP permite ejecutar código arbitrario en el servidor sin requerir autenticación al guardar el código PHP creado por el atacante en uno de los archivos del sitio web. Este problema afecta a todas las versiones del software MegaBIP.
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-02-16 CVE Reserved
- 2024-06-12 CVE Published
- 2024-08-01 CVE Updated
- 2025-02-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
- CAPEC-549: Local Execution of Code
References (4)
| URL | Tag | Source |
|---|---|---|
| https://cert.pl/en/posts/2024/06/CVE-2024-1576 | Third Party Advisory | |
| https://cert.pl/posts/2024/06/CVE-2024-1576 | Third Party Advisory | |
| https://megabip.pl | Product | |
| https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej | Government Resource |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|