PT-2020-15653 · Projectworlds · Projectworlds Car Rental Management System

Boku + 1 · Published 2020-09-09 · Updated 2020-09-10 · CVE-2020-24199

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Worlds Car Rental Management System version 1.0

Description The issue allows attackers to upload arbitrary files, potentially leading to remote code execution. This is due to a flaw in the Vehicle Image Upload component.

Recommendations For Project Worlds Car Rental Management System version 1.0, consider disabling the Vehicle Image Upload component until a patch is available to prevent exploitation. Restrict access to this component to minimize the risk of remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-24199

Affected Products

Projectworlds Car Rental Management System

References · 5

• 🔥 https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebApp · Exploit
• 🔥 https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebApp/blob/master/CarRental-Unauth-RCE.py · Exploit
• https://osv.dev/vulnerability/CVE-2020-24199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24199 · Security Note
• https://projectworlds.in/free-projects/php-projects/car-rental-project-in-php-and-mysql · Note