Paper/Archive/CVE-2024-1577

CVE-2024-1577

Jan Syski MegaBIP — Remote Code Execution in MegaBIP

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.3.663 × 2013.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2.

Affected

ProductAffectedFixed inSource

MegaBIP≤ 5.11.2–CNA

megabip≤ 5.11.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:D/RE:M/U:Amber

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/en/posts/2024/06/CVE-2024-1576 writeupcert.pl/posts/2024/06/CVE-2024-1576 refmegabip.pl refgov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej