Paper/Archive/CVE-2024-3948

CVE-2024-3948

SourceCodester Home Clean Service System — SourceCodester Home Clean Service System Photo student.add.php unrestricted upload

EPSS 0.9%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.4.584 × 2011.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file \admin\student.add.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261440.

Affected

ProductAffectedFixed inSource

Home Clean Service System1.0–CNA

home_cleaning_service_system1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refvuldb.com/?id.261440 refvuldb.com/?ctiid.261440 writeupvuldb.com/?submit.318722 exploitgithub.com/xuanluansec/vul/issues/5