PT-2024-30137 · Unknown · Kashipara Hotel Management System

Published 2024-08-22 · Updated 2024-08-26 · CVE-2024-42767

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kashipara Hotel Management System version 1.0

Description The issue concerns an Unrestricted File Upload vulnerability, allowing Remote Code Execution (RCE) through the /admin/add room controller.php endpoint. This means an attacker can upload malicious files to the system without proper restrictions, potentially leading to the execution of arbitrary code.

Recommendations For Kashipara Hotel Management System version 1.0, as a temporary workaround, consider disabling access to the /admin/add room controller.php endpoint until a patch is available. Restricting file uploads to only necessary and validated files can also help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-42767

Affected Products

Kashipara Hotel Management System

References · 9

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Unrestricted%20File%20Upload.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-42767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42767 · Security Note
• https://t.me/cvenotify/91792 · Telegram Post
• https://twitter.com/CVEnew/status/1826675851800535287 · Twitter Post
• https://t.me/cvedetector/3946 · Telegram Post
• https://twitter.com/cracbot/status/1828311574010118464 · Twitter Post
• https://cwe.mitre.org/data/definitions/434.html · Note
• https://twitter.com/VulmonFeeds/status/1826725221438525694 · Twitter Post