PT-2025-17959 · Serosoft · Serosoft Academia Student Information System

Published 2025-04-26 · Updated 2026-01-29 · CVE-2024-53636

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serosoft Academia Student Information System (SIS) EagleR version 1.0.118

Description An arbitrary file upload vulnerability via writefile.php allows attackers to execute arbitrary code via ../ in the filePath parameter. This issue enables attackers to upload files to arbitrary locations on the server, potentially leading to code execution.

Recommendations For Serosoft Academia Student Information System (SIS) EagleR version 1.0.118, consider disabling the writefile.php functionality until a patch is available to prevent exploitation. Restrict access to the filePath parameter in the affected API endpoint to minimize the risk of arbitrary file uploads.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2024-53636

Affected Products

Serosoft Academia Student Information System

References · 9

• 🔥 https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53636 · Exploit
• 🔥 https://github.com/el-viper/cve-research/tree/main/CVEs/CVE-2024-53636 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53636 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53636 · Vendor Advisory
• https://t.me/cveNotify/150291 · Telegram Post
• https://t.me/cvedetector/23806 · Telegram Post
• https://twitter.com/CVEnew/status/1916142806684295536 · Twitter Post
• https://t.me/cvenotify/119912 · Telegram Post
• https://t.me/cvetracker/22420 · Telegram Post