PT-2024-38922 · Feehicms · Feehicms

0Kooo

·

Published

2024-08-29

·

Updated

2024-09-02

·

CVE-2024-8295

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: FeehiCMS versions up to 2.1.1
Description: A critical issue has been found in FeehiCMS, affecting the createBanner function of the file /admin/index.php?r=banner%2Fbanner-create. The manipulation of the argument BannerForm[img] leads to unrestricted upload. This issue can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.
Recommendations: For FeehiCMS versions up to 2.1.1, as a temporary workaround, consider disabling the createBanner function until a patch is available. Restrict access to the /admin/index.php?r=banner%2Fbanner-create endpoint to minimize the risk of exploitation. Avoid using the BannerForm[img] argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8295
GHSA-3WRG-6MG5-JG2V

Affected Products

Feehicms