PT-2024-24473 · Unknown · Phpgurukul Tourism Management System

Published 2024-04-16 · Updated 2026-02-06 · CVE-2024-32256

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phpgurukul Tourism Management System version 2.0

Description The issue allows for Unrestricted Upload of File with Dangerous Type via the "/tms/admin/change-image.php" API endpoint. When updating a current package, there are no checks for what types of files are uploaded from the image.

Recommendations For Phpgurukul Tourism Management System version 2.0, consider disabling the image upload functionality in the "/tms/admin/change-image.php" endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of uploading malicious files.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-32256

Affected Products

Phpgurukul Tourism Management System

References · 9

• 🔥❌ https://github.com/jinhaochan/CVE-POC/blob/main/tms/POC.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-32256 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32256 · Vendor Advisory
• https://twitter.com/CVEnew/status/1780278112820908172 · Twitter Post
• https://t.me/cvenotify/76951 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780312245202719086 · Twitter Post
• https://exploit-db.com/exploits/51923 · Note
• https://t.me/cveNotify/151139 · Telegram Post
• https://t.me/cvenotify/117343 · Telegram Post