PT-2024-39325 · Unknown · Scriptcase

Rafael Pedrero

·

Published

2024-09-24

·

Updated

2024-10-02

·

CVE-2024-8940

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Scriptcase version 9.4.019
Description: The issue involves the arbitrary upload of a file via "/scriptcase/devel/lib/third/jquery plugin/jQuery-File-Upload/server/php/" via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input.
Recommendations: For version 9.4.019, ensure that user inputs are properly verified to prevent cyber attacks. As a temporary workaround, consider restricting access to the "/scriptcase/devel/lib/third/jquery plugin/jQuery-File-Upload/server/php/" endpoint until a patch is available. Update the application to a version that properly verifies user input to prevent the arbitrary upload of files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8940

Affected Products

Scriptcase