PT-2024-21287 · Sourcecodester · Sourcecodester File Manager App

Joshua Lictan + 1 · Published 2024-03-18 · Updated 2024-05-17 · CVE-2024-2604

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester File Manager App version 1.0

Description A critical issue has been found in the SourceCodester File Manager App, affecting the /endpoint/update-file.php file. The manipulation of the file argument leads to unrestricted upload. This issue can be exploited remotely.

Recommendations For SourceCodester File Manager App version 1.0, consider disabling the /endpoint/update-file.php endpoint until a patch is available to prevent unrestricted file uploads. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the file argument in the affected endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-2604

Affected Products

Sourcecodester File Manager App

References · 8

• 🔥❌ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20File%20Manager%20App/Arbitrary%20File%20Upload%20-%20update-file.php.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-2604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2604 · Security Note
• https://vuldb.com/?id.257182 · Note
• https://twitter.com/CVEnew/status/1769835329211842734 · Twitter Post
• https://t.me/cvenotify/74214 · Telegram Post
• https://vuldb.com/?ctiid.257182 · Note
• https://t.me/cvenotify/74195 · Telegram Post