PT-2020-12680 · Projectworlds · Project Worlds Official Car Rental System

Published 2020-04-06 · Updated 2020-04-06 · CVE-2020-11544

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Worlds Official Car Rental System version 1

Description The issue allows an admin user to run commands on the server with their account due to an arbitrary file upload vulnerability via the add cars.php file in the upload section on the file-manager page. There are no restrictions for uploading executable files, which can be exploited.

Recommendations For Project Worlds Official Car Rental System version 1, restrict access to the add cars.php file to prevent arbitrary file uploads until a fix is available. Consider implementing upload restrictions for executable files as a temporary mitigation measure.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-11544

Affected Products

Project Worlds Official Car Rental System

References · 4

• 🔥 https://frostylabs.net/writeups/cve-2020-11544 · Exploit
• https://osv.dev/vulnerability/CVE-2020-11544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11544 · Security Note
• https://t.me/cvenotify/2438 · Telegram Post