PT-2024-27797 · Unknown · Itsourcode Online Discussion Forum Project

Limanshu + 2 · Published 2024-10-04 · Updated 2024-10-09 · CVE-2024-37869

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Itsourcecode Online Discussion Forum Project version 1.0

Description The issue allows a remote attacker to execute arbitrary code via the "poster.php" file. The uploaded file is received using the $ FILES variable. This enables the attacker to potentially compromise the system.

Recommendations For Itsourcecode Online Discussion Forum Project version 1.0, consider disabling the file upload functionality in the "poster.php" file until a patch is available. Restrict access to the $ FILES variable to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-37869

Affected Products

Itsourcode Online Discussion Forum Project

References · 11

• 🔥 https://github.com/TERRENCE-REX/CVE/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-37869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37869 · Security Note
• https://t.me/cvenotify/97508 · Telegram Post
• https://t.me/cvenotify/97101 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842337844053913881 · Twitter Post
• https://twitter.com/CVEnew/status/1842312501243097157 · Twitter Post
• https://twitter.com/cracbot/status/1843894229774544957 · Twitter Post
• https://twitter.com/cracbot/status/1843531882123931781 · Twitter Post
• https://t.me/cvedetector/7029 · Telegram Post
• https://gist.github.com/TERRENCE-REX/7e5dfdd3583bf9fd81196f557a8b8879 · Note