by Kastro
Paper/Archive/CVE-2024-11018

CVE-2024-11018

Grand Vice info Webopac — Grand Vice info Webopac - Arbitrary File Upload

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.7.577 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which could lead to arbitrary code execution on the server.

Affected

ProductAffectedFixed inSource
Webopac6 – < 6.5.16.5.1CNA
Webopac7 – < 7.2.37.2.3CNA
webopac6.0 – < 6.5.16.5.1CISA-ADP
webopac7.0 – < 7.2.37.2.3CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorytwcert.org.tw/tw/cp-132-8213-3413b-1.htmladvisorytwcert.org.tw/en/cp-139-8214-64fa2-2.html