CVE-2024-34982

CRITICALNuclei

LyLme-Spage - Arbitary File Upload

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-34982 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 17, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

lylme_spage

Browse lylme / lylme_spage

Default status: unknown

CVE List1.9.5affected

Nuclei templates

1
ProjectDiscoveryHIGHLyLme-Spage - Arbitary File Upload

An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a crafted file.

Impact

Attackers can upload arbitrary files to execute malicious code on the LyLme-Spage server.

Remediation

Update LyLme Spage to a version later than 1.9.5 that patches the arbitrary file upload vulnerability.

AuthorsDhiyaneshDk
Template tagscvecve2024lylme-spagerceintrusivevuln
CPE: cpe:2.3:a:lylme:lylme_spage:*:*:*:*:*:*:*:*
FOFA: icon_hash="-282504889"
https://github.com/n2ryx/CVE/blob/main/Lylme_pagev1.9.5.md https://github.com/tanjiti/sec_profile https://github.com/ATonysan/poc-exp/blob/main/60NavigationPage_CVE-2024-34982_ArbitraryFileUploads.py

Source: ProjectDiscovery

References

2