PT-2025-2801 · Gestioip · Gestioip
Maximiliano Belino
·
Published
2025-01-14
·
Updated
2026-05-15
·
CVE-2024-48760
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
GestioIP version 3.5.7
Description:
An issue in GestioIP allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious
perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution.Recommendations:
For GestioIP version 3.5.7, as a temporary workaround, consider disabling the file upload function until a patch is available. Restrict access to the
upload.cgi file to minimize the risk of exploitation. Avoid using the file upload feature in GestioIP until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gestioip