PT-2024-21657 · Unknown · Soplanning

Hidde Smit + 1 · Published 2024-09-11 · Updated 2024-09-18 · CVE-2024-27115

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:I/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions SO Planning online planning tool versions prior to 1.52.02

Description A Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool, allowing an attacker to upload executable files to a publicly accessible folder without verifying any requirements. This leads to the possibility of executing code on the underlying system when the file is triggered.

Recommendations For versions prior to 1.52.02, update to version 1.52.02 to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-27115

Affected Products

Soplanning

References · 8

• 🔥 https://github.com/theexploiters/CVE-2024-27115-Exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27115 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27115 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1833911807360057828 · Twitter Post
• https://t.me/cvedetector/5359 · Telegram Post
• https://csirt.divd.nl/CVE-2024-27115 · Note
• https://twitter.com/CVEnew/status/1833865956306858176 · Twitter Post
• https://twitter.com/CveFindCom/status/1833868606636998845 · Twitter Post