CVE-2024-44849

CRITICALNuclei

Qualitor checkAcesso.php Remote Code Execution Vulnerability

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-44849 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 8, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Qualitor ITSM

Browse Qualitor / Qualitor ITSM
VulnCheckVersion data not supplied

qalitor

Browse qualitor / qalitor

Default status: unknown

CVE ListThrough 8.24affected

Proofs of concept

1

Repository PoCs

GitHubextencil/CVE-2024-44849Repository PoCby extencil5Not analyzed3 files

4.7 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALQualitor <= 8.24 - Remote Code ExecutionCVSS 9.8

Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

Impact

Unauthenticated attackers can upload malicious files to achieve remote code execution on the Qualitor server.

Remediation

Update Qualitor to version later than 8.24 that patches the arbitrary file upload vulnerability.

WeaknessesCWE-434
Authorss4e-io
Template tagscvecve2024rcefile-uploadqualitorintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FOFA: Qualitor
https://cvefeed.io/vuln/detail/CVE-2024-44849 https://nvd.nist.gov/vuln/detail/CVE-2024-44849 https://github.com/extencil/CVE-2024-44849 https://blog.extencil.me/information-security/cves/cve-2024-44849 https://sploitus.com/exploit?id=D08D686E-7910-5E17-99CC-36407B9884B8

Source: ProjectDiscovery

References

4