PT-2024-18275 · Unknown · Temmokumvc

Glzjin · Published 2024-02-22 · Updated 2024-12-31 · CVE-2024-1750

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TemmokuMVC versions up to 2.3

Description A critical issue was found in the function get img url/img replace in the library lib/images get down.php of the component Image Download Handler. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations For TemmokuMVC versions up to 2.3, as a temporary workaround, consider disabling the get img url/img replace function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-1750

Affected Products

Temmokumvc

References · 8

• 🔥 https://note.zhaoj.in/share/OrBH8zLKUPOA · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1750 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1750 · Vendor Advisory
• https://vuldb.com/?ctiid.254532 · Note
• https://t.me/cvenotify/72257 · Telegram Post
• https://t.me/cvenotify/105838 · Telegram Post
• https://vuldb.com/?id.254532 · Note
• https://twitter.com/CVEnew/status/1760760189291041077 · Twitter Post