PT-2024-26230 · Unknown · Itsourcecode Payroll Management System

Shellunease · Published 2024-06-17 · Updated 2024-08-05 · CVE-2024-34833

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Payroll Management System version 1.0

Description The issue allows an unauthenticated attacker to upload a malicious PHP file via the "save settings" page, which is intended for image uploads. This can lead to the execution of arbitrary code as the user running the web server.

Recommendations For Sourcecodester Payroll Management System version 1.0, consider disabling the file upload functionality on the "save settings" page until a patch is available to prevent exploitation. Restrict access to the "save settings" page to minimize the risk of uploading malicious files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-34833

Affected Products

Itsourcecode Payroll Management System

References · 5

• 🔥 https://github.com/ShellUnease/payroll-management-system-rce · Exploit
• 🔥 https://packetstormsecurity.com/files/179106/Payroll-Management-System-1.0-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34833 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34833 · Vendor Advisory
• https://t.me/cvenotify/83579 · Telegram Post