CVE-2024-7910

A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
References
Link Resource
https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md Exploit
https://vuldb.com/?ctiid.275036 Permissions Required VDB Entry
https://vuldb.com/?id.275036 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?submit.391650 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:online_railway_reservation_system_project:online_railway_reservation_system:1.0:*:*:*:*:*:*:*

History

19 Aug 2024, 18:49

Type Values Removed Values Added
First Time Online Railway Reservation System Project
Online Railway Reservation System Project online Railway Reservation System
CVSS v2 : 5.8
v3 : 4.7
v2 : 5.8
v3 : 7.2
CPE cpe:2.3:a:online_railway_reservation_system_project:online_railway_reservation_system:1.0:*:*:*:*:*:*:*
References () https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md - () https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md - Exploit
References () https://vuldb.com/?ctiid.275036 - () https://vuldb.com/?ctiid.275036 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.275036 - () https://vuldb.com/?id.275036 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.391650 - () https://vuldb.com/?submit.391650 - Third Party Advisory, VDB Entry

19 Aug 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en CodeAstro Online Railway Reservation System 1.0 y clasificada como crítica. Una función desconocida del archivo /admin/emp-profile-avatar.php del componente Profile Photo Update Handler es afectada por esta vulnerabilidad. La manipulación conduce a una carga sin restricciones. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse.

18 Aug 2024, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-18 19:15

Updated : 2024-08-19 18:49


NVD link : CVE-2024-7910

Mitre link : CVE-2024-7910

CVE.ORG link : CVE-2024-7910


JSON object : View

Products Affected

online_railway_reservation_system_project

  • online_railway_reservation_system
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type