PT-2024-33169 · Sage · Sage 1000

Published 2024-10-20 · Updated 2025-06-27 · CVE-2024-48646

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sage 1000 version 7.0.0

Description The issue allows authorized users to upload files without proper validation, which can be exploited by uploading malicious files, such as HTML, scripts, or other executable content. This could lead to the execution of these files on the server and result in further system compromise.

Recommendations For Sage 1000 version 7.0.0, consider restricting file uploads to only authorized and validated files to prevent potential exploitation. As a temporary workaround, restrict access to the file upload feature until a proper validation mechanism is implemented.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-48646

Affected Products

Sage 1000

References · 7

• 🔥 https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-48646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48646 · Security Note
• https://t.me/cvenotify/126947 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1848071412709245337 · Twitter Post
• https://t.me/cvedetector/9449 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1848068852728430996 · Twitter Post