CVE-2024-7495
itsourcecode Laravel Accounting System HomeController.php unrestricted upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273621 was assigned to this vulnerability.
Una vulnerabilidad fue encontrada en el código fuente Laravel Accounting System 1.0 y clasificada como crítica. Esto afecta a una parte desconocida del archivo app/Http/Controllers/HomeController.php. La manipulación de la imagen del argumento conduce a una carga sin restricciones. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-273621.
Es wurde eine kritische Schwachstelle in itsourcecode Laravel Accounting System 1.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei app/Http/Controllers/HomeController.php. Durch das Manipulieren des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-08-05 CVE Reserved
- 2024-08-06 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2024-08-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://vuldb.com/?id.273621 | Technical Description | |
https://vuldb.com/?submit.385829 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/DeepMountains/Mirage/blob/main/CVE13-1.md | 2024-08-07 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Itsourcecode Search vendor "Itsourcecode" | Laravel Accounting System Search vendor "Itsourcecode" for product "Laravel Accounting System" | 1.0 Search vendor "Itsourcecode" for product "Laravel Accounting System" and version "1.0" | en |
Affected
|