PT-2024-38674 · Dedebiz · Dedebiz

Dee.Mirage · Published 2024-08-18 · Updated 2024-08-25 · CVE-2024-7904

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DedeBIZ version 6.3.0

Description A critical issue was found in DedeBIZ, affecting some unknown functionality of the file admin/file manage control.php of the component File Extension Handler. The manipulation of the upfile1 argument leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For DedeBIZ version 6.3.0, update to version 6.3.1 as soon as possible to stay secure. As a temporary workaround, consider restricting access to the admin/file manage control.php file and the upfile1 argument to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-7904

Affected Products

Dedebiz

References · 16

• 🔥 https://github.com/DeepMountains/Mirage/blob/main/CVE17-2.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7904 · Security Note
• https://twitter.com/CveFindCom/status/1826771522842660868 · Twitter Post
• https://t.me/cvenotify/91040 · Telegram Post
• https://vuldb.com/?submit.388361 · Note
• https://twitter.com/transilienceai/status/1827661314749038913 · Twitter Post
• https://twitter.com/transilienceai/status/1827661309887840500 · Twitter Post
• https://t.me/cvedetector/3441 · Telegram Post
• https://vuldb.com/?id.275030 · Note
• https://twitter.com/CVEnew/status/1825093099367903415 · Twitter Post
• https://twitter.com/cracbot/status/1826861981225419040 · Twitter Post
• https://vuldb.com/?ctiid.275030 · Note
• https://twitter.com/VulmonFeeds/status/1825117892083347893 · Twitter Post
• https://twitter.com/transilienceai/status/1827661300450623635 · Twitter Post