PT-2024-16832 · Sourcecodester · Sourcecodester Best Employee Management System

Sh3Rl0Ckpgp · Published 2024-11-14 · Updated 2024-11-19 · CVE-2024-11214

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Best Employee Management System version 1.0

Description A critical issue has been found in the SourceCodester Best Employee Management System, affecting the file /admin/profile.php. The manipulation of the website image argument leads to unrestricted upload. This issue can be initiated remotely.

Recommendations For version 1.0, update to the latest release immediately to mitigate risks. As a temporary workaround, consider restricting access to the /admin/profile.php file until a patch is available. Avoid using the website image argument in the affected file until the issue is resolved.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2024-11214

Affected Products

Sourcecodester Best Employee Management System

References · 18

• 🔥 https://github.com/sh3rl0ckpggp/0day/blob/main/Employee_management%20_system_RCE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11214 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11214 · Vendor Advisory
• https://twitter.com/transilienceai/status/1858016968227336377 · Twitter Post
• https://twitter.com/transilienceai/status/1858016991572889817 · Twitter Post
• https://twitter.com/transilienceai/status/1858016986439008326 · Twitter Post
• https://twitter.com/transilienceai/status/1858016996333400174 · Twitter Post
• https://sourcecodester.com · Note
• https://twitter.com/transilienceai/status/1858017001790214400 · Twitter Post
• https://twitter.com/transilienceai/status/1858016963580101092 · Twitter Post
• https://twitter.com/CVEnew/status/1857096358575931567 · Twitter Post
• https://vuldb.com/?submit.443304 · Note
• https://twitter.com/transilienceai/status/1858017005716008991 · Twitter Post
• https://vuldb.com/?ctiid.284530 · Note
• https://t.me/cvedetector/10972 · Telegram Post