PT-2024-33348 · Sourcecodester · Sourcecodester Employee/Visitor Gate Pass Logging System

Schnee · Published 2024-05-16 · Updated 2025-02-10 · CVE-2024-4921

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Employee and Visitor Gate Pass Logging System version 1.0

Description A critical vulnerability has been found in the system, affecting an unknown function of the file /employee gatepass/classes/Users.php?f=ssave. The manipulation of the img argument leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, patch the system immediately and validate input sanitization to prevent unrestricted upload. As a temporary workaround, consider restricting access to the /employee gatepass/classes/Users.php file to minimize the risk of exploitation. Avoid using the img argument in the affected file until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-4921

Affected Products

Sourcecodester Employee/Visitor Gate Pass Logging System

References · 9

• 🔥 https://github.com/I-Schnee-I/cev/blob/main/upload.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-4921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4921 · Security Note
• https://vuldb.com/?submit.333662 · Note
• https://twitter.com/oktsec/status/1810466280765354262 · Twitter Post
• https://vuldb.com/?id.264456 · Note
• https://t.me/cvenotify/110525 · Telegram Post
• https://vuldb.com/?ctiid.264456 · Note
• https://t.me/cvenotify/79955 · Telegram Post