PT-2024-15369 · Unknown · Rrj Nueva Ecija Engineer Online Portal

Ahmed8199 · Published 2024-01-01 · Updated 2024-05-17 · CVE-2024-0185

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RRJ Nueva Ecija Engineer Online Portal version 1.0

Description A critical issue affects the processing of the file dasboard teacher.php of the component Avatar Handler, leading to unrestricted upload. The attack may be initiated remotely.

Recommendations For RRJ Nueva Ecija Engineer Online Portal version 1.0, as a temporary workaround, consider disabling the Avatar Handler component until a patch is available. Restrict access to the dasboard teacher.php file to minimize the risk of exploitation. Avoid using the vulnerable component for uploading files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-0185

Affected Products

Rrj Nueva Ecija Engineer Online Portal

References · 9

• 🔥 https://mega.nz/file/PBd13AoR#G3fYWB82wGCa7sD22JP3_twtbw3B0qSJ-4eMMrYR5cE · Exploit
• https://osv.dev/vulnerability/CVE-2024-0185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0185 · Security Note
• https://vuldb.com/?id.249443 · Note
• https://t.me/cvenotify/66638 · Telegram Post
• https://twitter.com/NUYTSTECH/status/1744204834906210601 · Twitter Post
• https://twitter.com/CVEnew/status/1741988627716911186 · Twitter Post
• https://vuldb.com/?ctiid.249443 · Note
• https://t.me/cibsecurity/74120 · Telegram Post