github.comexploit
https://github.com/LiAoRJ/CVE_Hunter/blob/main/RCE-1.md CVE-2024-2394
MEDIUM
SourceCodester Employee Management System add-admin.php unrestricted upload
Record summary
CVE-2024-2394 has a selected CVSS score of 4.7 (medium).
Description
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/add-admin.php. The manipulation of the argument avatar leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256454 is the identifier assigned to this vulnerability.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 15, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Employee Management SystemBrowse SourceCodester / Employee Management SystemDefault status: unknown | CVE List | 1.0 | affected |
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-2394 VDB-256454 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.256454 VDB-256454 | SourceCodester Employee Management System add-admin.php unrestricted uploadvdb entryTechnical description
https://vuldb.com/?id.256454