PT-2020-15655 · Projects World House Rental · Projects World House Rental

Boku + 1 · Published 2020-08-27 · Updated 2020-08-31 · CVE-2020-24202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Projects World House Rental version 1.0

Description The File Upload component in the software suffers from an arbitrary file upload issue, allowing remote attackers to conduct code execution. This affects regular users.

Recommendations For version 1.0, restrict access to the File Upload component to prevent exploitation until a fix is available. Consider disabling the file upload functionality temporarily as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-24202

Affected Products

Projects World House Rental

References · 4

• 🔥 https://github.com/hyd3sec/HouseRental_Unauth_RCE/blob/master/HouseRentalRCE.py · Exploit
• 🔥 https://projectworlds.in/free-projects/php-projects/house-rental-and-property-listing-project-php-mysql · Exploit
• https://osv.dev/vulnerability/CVE-2020-24202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24202 · Security Note