by Kastro
Paper/Archive/CVE-2024-8170

CVE-2024-8170

SourceCodester Zipped Folder Manager App — SourceCodester Zipped Folder Manager App add-folder.php unrestricted upload

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.6.556 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
Zipped Folder Manager App1.0–CNA
zipped_folder_manager_app1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
VulDB (CNA)3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
VulDB (CNA)3.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.275769refvuldb.com/?ctiid.275769writeupvuldb.com/?submit.397719exploitgithub.com/jadu101/CVE/blob/main/SourceCodester_Zipped_Folder_Manager_App_File_Upload.mdrefsourcecodester.com