CVE-2024-6280
SourceCodester Simple Online Bidding System unrestricted upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269493 was assigned to this vulnerability.
Se encontró una vulnerabilidad en SourceCodester Simple Online Bidding System 1.0. Ha sido clasificada como crítica. Esto afecta a una parte desconocida del archivo /admin/ajax.php?action=save_settings. La manipulación del argumento img conduce a una carga sin restricciones. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-269493.
Es wurde eine Schwachstelle in SourceCodester Simple Online Bidding System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/ajax.php?action=save_settings. Durch Manipulation des Arguments img mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-06-23 CVE Reserved
- 2024-06-24 CVE Published
- 2024-08-01 CVE Updated
- 2024-08-01 First Exploit
- 2024-09-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://vuldb.com/?id.269493 | Technical Description | |
https://vuldb.com/?submit.363054 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/Isfulou/cve/blob/main/upload.md | 2024-08-01 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
SourceCodester Search vendor "SourceCodester" | Simple Online Bidding System Search vendor "SourceCodester" for product "Simple Online Bidding System" | 1.0 Search vendor "SourceCodester" for product "Simple Online Bidding System" and version "1.0" | en |
Affected
|