CVE-2024-31777

CRITICAL

openeclass < 3.15 - Remote Code Execution via certbadge.php File Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2024-31777. PoCs published by George Tsimpidas, FreySolarEye.

AI-analyzed exploit summary This exploit leverages an unrestricted file upload vulnerability in GUnet OpenEclass 3.15 via the 'certbadge.php' endpoint, allowing an authenticated attacker to upload a malicious PHP file and achieve remote code execution.

Description

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.

Exploits (2)

exploitdb WORKING POC
by George Tsimpidas · textwebappsphp
https://www.exploit-db.com/exploits/51975

This exploit leverages an unrestricted file upload vulnerability in GUnet OpenEclass 3.15 via the 'certbadge.php' endpoint, allowing an authenticated attacker to upload a malicious PHP file and achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GUnet OpenEclass 3.15
Auth required
Prerequisites: Valid credentials for the OpenEclass platform · Access to the 'certbadge.php' upload functionality
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by FreySolarEye · poc
https://github.com/FreySolarEye/Exploit-CVE-2024-31777

This repository contains a functional exploit for CVE-2024-31777, which leverages an unrestricted file upload vulnerability in GUnet OpenEclass to achieve remote code execution. The exploit authenticates as an admin, uploads a malicious PHP payload via a ZIP file, and executes arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: GUnet OpenEclass (version not specified, likely <= 3.16)
Auth required
Prerequisites: Admin credentials for OpenEclass · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.3039
EPSS Percentile 96.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
openeclass/openeclass < 3.15
Published Jun 13, 2024
Tracked Since Feb 18, 2026