PT-2024-18145 · Megabip · Megabip

Krzysztof Gawkowski · Published 2024-06-12 · Updated 2024-08-14 · CVE-2024-1577

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MegaBIP software versions through 5.11.2

Description The issue allows for Remote Code Execution on the server without requiring authentication. This is achieved by saving crafted PHP code to one of the website files.

Recommendations For versions through 5.11.2, consider restricting access to the file system to prevent arbitrary code execution until a patch is available. As a temporary workaround, consider disabling the execution of PHP code in website files to minimize the risk of exploitation. Avoid using the affected MegaBIP software versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-1577

Affected Products

Megabip

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-1577 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1577 · Vendor Advisory
• https://t.me/cvenotify/90517 · Telegram Post
• https://cert.pl/posts/2024/06/CVE-2024-1576 · Note
• https://t.me/cvenotify/83625 · Telegram Post
• https://cert.pl/en/posts/2024/06/CVE-2024-1576 · Note
• https://t.me/cvenotify/83006 · Telegram Post
• https://megabip.pl · Note
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note