CVE-2024-2059
Vulnerability from cvelistv5
Published
2024-03-01 11:31
Modified
2024-08-01 19:03
Severity
4.7 (Medium) - cvssV3_1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Summary
SourceCodester Petrol Pump Management Software service_crud.php unrestricted upload
References
Impacted products
Vendor | Product |
---|---|
SourceCodester | Petrol Pump Management Software |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:sourcecodester:petrol_pump_management:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "petrol_pump_management", "vendor": "sourcecodester", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-2059", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-26T18:39:21.664539Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-26T20:17:20.242Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T19:03:38.698Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "VDB-255374 | SourceCodester Petrol Pump Management Software service_crud.php unrestricted upload", "tags": [ "vdb-entry", "technical-description", "x_transferred" ], "url": "https://vuldb.com/?id.255374" }, { "name": "VDB-255374 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required", "x_transferred" ], "url": "https://vuldb.com/?ctiid.255374" }, { "tags": [ "exploit", "x_transferred" ], "url": "https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/service_crud.php%20Unauthenticated%20Arbitrary%20File%20Upload.md" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Petrol Pump Management Software", "vendor": "SourceCodester", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Joshua Lictan" }, { "lang": "en", "type": "reporter", "value": "nochizplz (VulDB User)" }, { "lang": "en", "type": "analyst", "value": "nochizplz (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability." }, { "lang": "de", "value": "Eine kritische Schwachstelle wurde in SourceCodester Petrol Pump Management Software 1.0 ausgemacht. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /admin/app/service_crud.php. Durch das Beeinflussen des Arguments photo mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV3_1": { "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-01T11:31:05.750Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-255374 | SourceCodester Petrol Pump Management Software service_crud.php unrestricted upload", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.255374" }, { "name": "VDB-255374 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.255374" }, { "tags": [ "exploit" ], "url": "https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/service_crud.php%20Unauthenticated%20Arbitrary%20File%20Upload.md" } ], "timeline": [ { "lang": "en", "time": "2024-03-01T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-03-01T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-03-01T11:14:36.000Z", "value": "VulDB entry last update" } ], "title": "SourceCodester Petrol Pump Management Software service_crud.php unrestricted upload" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-2059", "datePublished": "2024-03-01T11:31:05.750Z", "dateReserved": "2024-03-01T06:52:40.209Z", "dateUpdated": "2024-08-01T19:03:38.698Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-2059\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2024-03-01T12:15:48.890\",\"lastModified\":\"2024-05-17T02:38:00.740\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-255374 is the identifier assigned to this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una vulnerabilidad en SourceCodester Petrol Pump Management Software 1.0. Ha sido calificada como cr\u00edtica. Una funci\u00f3n desconocida del archivo /admin/app/service_crud.php es afectada por esta vulnerabilidad. La manipulaci\u00f3n de la foto del argumento da lugar a una subida sin restricciones. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. VDB-255374 es el identificador asignado a esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.2,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:M/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"MULTIPLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":5.8},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.4,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-434\"}]}],\"references\":[{\"url\":\"https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/service_crud.php%20Unauthenticated%20Arbitrary%20File%20Upload.md\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?ctiid.255374\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/?id.255374\",\"source\":\"cna@vuldb.com\"}]}}" } }
Loading...