Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-27115. PoCs published by theexploiters. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional exploit for CVE-2024-27115, targeting SOPlanning 1.52.01. It leverages authenticated file upload to achieve remote code execution via a PHP web shell.
Description
A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. With this vulnerability, an attacker can upload executable files that are moved to a publicly accessible folder before verifying any requirements. This leads to the possibility of execution of code on the underlying system when the file is triggered. The vulnerability has been remediated in version 1.52.02.
Exploits (1)
This is a functional exploit for CVE-2024-27115, targeting SOPlanning 1.52.01. It leverages authenticated file upload to achieve remote code execution via a PHP web shell.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H