PT-2025-3456 · Unknown · Code-Projects Online Car Rental System

Aaryan Golatkar · Published 2025-01-13 · Updated 2025-01-13 · CVE-2024-57487

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code-Projects Online Car Rental System version 1.0

Description The file upload feature in the affected system does not validate file extensions or MIME types, allowing an attacker to upload a PHP shell without restrictions and execute commands on the server.

Recommendations For Code-Projects Online Car Rental System version 1.0, consider disabling the file upload feature until a patch is available to prevent the upload of malicious files, such as PHP shells, and restrict access to sensitive server areas to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-57487

Affected Products

Code-Projects Online Car Rental System

References · 7

• 🔥 https://github.com/aaryan-11-x/CVE-2024-57487-and-CVE-2024-57488 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57487 · Security Note
• https://t.me/cvedetector/15159 · Telegram Post
• https://code-projects.org/online-car-rental-using-php-source-code · Note
• https://t.me/cvenotify/107220 · Telegram Post
• https://twitter.com/CVEnew/status/1878852772566532164 · Twitter Post