PT-2024-21409 · Greek Universities Network · Open Eclass

Published 2024-03-14 · Updated 2024-08-28 · CVE-2024-26503

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Greek Universities Network Open eClass versions 3.15 and earlier

Description The issue allows attackers to run arbitrary code via the upload of a crafted file to the "certbadge.php" endpoint. This enables potential exploitation for malicious purposes.

Recommendations For versions 3.15 and earlier, consider disabling the upload functionality to the "certbadge.php" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint for file uploads until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-26503

Affected Products

Open Eclass

References · 7

• 🔥 https://less-secure.com/2024/03/open-eclass-cve-2024-26503-unrestricted.html · Exploit
• https://osv.dev/vulnerability/CVE-2024-26503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26503 · Security Note
• https://twitter.com/CVEnew/status/1768387887618547939 · Twitter Post
• https://t.me/cvenotify/73911 · Telegram Post
• https://t.me/cvenotify/73847 · Telegram Post
• https://t.me/cvenotify/92507 · Telegram Post