Paper/Archive/CVE-2024-50648

CVE-2024-50648

yshopmall yshopmall — yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured t…

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 63.1.631 × 2012.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

yshopmall1.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/Yllxx03/CVE/blob/main/yshop_fileu_pload.md refgithub.com/Yllxx03/CVE/tree/main/CVE-2024-50648