PT-2025-2066 · Unknown · Donglight Bookstore电商书城系统说明

Lvzc1 · Published 2025-01-09 · Updated 2025-01-09 · CVE-2024-13210

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions donglight bookstore电商书城系统说明 version 1.0

Description A critical issue has been found in the uploadPicture function of the AdminBookController class, located in the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController.java. The manipulation of the pictureFile argument leads to unrestricted upload. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

Recommendations For version 1.0, as a temporary workaround, consider disabling the uploadPicture function until a patch is available. Restrict access to the pictureFile argument in the uploadPicture function to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2024-13210

Affected Products

Donglight Bookstore电商书城系统说明

References · 11

• 🔥 https://github.com/donglight/bookstore/issues/10#issue-2760923048 · Exploit
• 🔥 https://github.com/donglight/bookstore/issues/10 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13210 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13210 · Vendor Advisory
• https://vuldb.com/?id.290815 · Note
• https://twitter.com/VulmonFeeds/status/1877241288371654931 · Twitter Post
• https://vuldb.com/?submit.469686 · Note
• https://t.me/cvenotify/106868 · Telegram Post
• https://t.me/cvedetector/14776 · Telegram Post
• https://twitter.com/CVEnew/status/1877256329716445672 · Twitter Post
• https://vuldb.com/?ctiid.290815 · Note