PT-2024-25828 · Sourcecodester · Sourcecodester Prison Management System

Li Yu · Published 2024-04-07 · Updated 2024-05-18 · CVE-2024-3437

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Prison Management System version 1.0

Description A critical issue affects the Avatar Handler component, specifically the file /Admin/add-admin.php. The manipulation of the avatar argument leads to unrestricted upload. This issue can be exploited remotely.

Recommendations For SourceCodester Prison Management System version 1.0, consider disabling the Avatar Handler component or restricting access to the /Admin/add-admin.php file until a patch is available. Avoid using the avatar argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-3437

Affected Products

Sourcecodester Prison Management System

References · 9

• 🔥 https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-3437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3437 · Security Note
• https://t.me/cvenotify/75991 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777212319916867990 · Twitter Post
• https://vuldb.com/?ctiid.259631 · Note
• https://vuldb.com/?submit.311920 · Note
• https://vuldb.com/?id.259631 · Note
• https://t.me/cvenotify/80341 · Telegram Post