CVE-2024-57487

MEDIUM

Car Rental System 1.0 File Upload RCE (Authenticated)

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-57487 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute commands on the server.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2025 · Source: CVE List

Proofs of concept

2

Catalogued exploits

MetasploitCar Rental System 1.0 File Upload RCE (Authenticated)Metasploit exploitby Aaryan GolatkarNot analyzed1 file

Ruby

Metasploit
PoC details

Repository PoCs

GitHubaaryan-11-x/CVE-2024-57487-and-CVE-2024-57488Repository PoCby aaryan-11-x0Not analyzed4 files

15.4 KiB · linked to 2 vulnerabilities

GitHub
PoC details

References

3