PT-2024-17826 · Unknown · 1000 Projects Portfolio Management System Mca

Wangjiawei · Published 2024-12-26 · Updated 2024-12-26 · CVE-2024-12954

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1000 Projects Portfolio Management System MCA version 1.0

Description A critical vulnerability was found in the 1000 Projects Portfolio Management System MCA. This issue affects an unknown part of the file /update ach.php. The manipulation of the argument ach certy leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the upload functionality related to the ach certy argument in the /update ach.php file until a patch is available. Restrict access to the /update ach.php file to minimize the risk of exploitation. Avoid using the ach certy argument in the affected file until the issue is resolved.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2024-12954

Affected Products

1000 Projects Portfolio Management System Mca

References · 11

• 🔥 https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README5.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12954 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12954 · Vendor Advisory
• https://vuldb.com/?id.289317 · Note
• https://twitter.com/CVEnew/status/1872289040025710861 · Twitter Post
• https://t.me/cvedetector/13680 · Telegram Post
• https://t.me/cvenotify/105494 · Telegram Post
• https://1000projects.org · Note
• https://twitter.com/VulmonFeeds/status/1872313533892805084 · Twitter Post
• https://vuldb.com/?submit.468772 · Note
• https://vuldb.com/?ctiid.289317 · Note