PT-2024-38921 · Feehicms · Feehicms

0Kooo

·

CVE-2024-8294

·

Published

2024-08-29

·

Updated

2024-09-02

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: FeehiCMS versions up to 2.1.1
Description: A critical vulnerability was found in FeehiCMS, affecting the function update of the file /admin/index.php?r=friendly-link%2Fupdate. The manipulation of the argument FriendlyLink[image] leads to unrestricted upload. It is possible to initiate the attack remotely.
Recommendations: For FeehiCMS versions up to 2.1.1, as a temporary workaround, consider disabling the update function of the file /admin/index.php?r=friendly-link%2Fupdate until a patch is available. Restrict access to the FriendlyLink[image] argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8294
GHSA-XXQW-83C7-R24R

Affected Products

Feehicms