PT-2024-19582 · Akaunting · Akaunting

U32I · Published 2024-02-08 · Updated 2024-02-15 · CVE-2024-22836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Akaunting versions 3.1.3 and earlier

Description An OS command injection issue exists, allowing an attacker to manipulate the company locale during app installation to execute system commands on the hosting server.

Recommendations For versions 3.1.3 and earlier, update to a version later than 3.1.3 to resolve the issue. As a temporary workaround, consider restricting the ability to install apps or manipulate the company locale to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-22836

Affected Products

Akaunting

References · 8

• 🔥 https://github.com/u32i/cve/tree/main/CVE-2024-22836 · Exploit
• 🔥 https://exploit-db.com/exploits/51870 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22836 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22836 · Vendor Advisory
• https://github.com/akaunting/akaunting/releases/tag/3.1.4 · Note
• https://twitter.com/VulmonFeeds/status/1755710156556358108 · Twitter Post
• https://akaunting.com · Note
• https://twitter.com/CVEnew/status/1755677249020325926 · Twitter Post