CVE-2024-28441

CRITICAL

magicflue < 7.0 - Remote Code Execution via mail/mailupdate.jsp messageid Parameter

Title source: llm

Description

File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0123

EPSS Percentile 65.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

magicflue/magicflue < 7.0

Published Mar 22, 2024

Tracked Since Feb 18, 2026