Paper/Archive/CVE-2024-6084

CVE-2024-6084

itsourcecode Pool of Bethesda Online Reservation System — itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload

EPSS 0.9%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.7.587 × 2011.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268825 was assigned to this vulnerability.

Affected

ProductAffectedFixed inSource

Pool of Bethesda Online Reservation System1.0–CNA

pool_of_bethesda_online_reservation_system1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.268825 refvuldb.com/?ctiid.268825 writeupvuldb.com/?submit.358628 exploitgithub.com/Laster-dev/CVE/issues/2