CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted upload
CVE-2024-0194

6.3MEDIUM

Key Information:

Vendor: Codeastro
Status: Internet Banking System
Vendor: CVE Published:; 2 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-0194?

A vulnerability has been identified in the CodeAstro Internet Banking System, specifically within the Profile Picture Handler component of the application. This issue allows attackers to exploit the pages_account.php file, facilitating unrestricted file uploads. The vulnerability can be triggered remotely, which may lead to unauthorized file manipulation or the deployment of malicious files on the server. The potential for exploitation has been publicly disclosed, emphasizing the importance of immediate attention to this security flaw to protect user data and system integrity.

Affected Version(s)

Internet Banking System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0194 - Proof of Concept

References

https://vuldb.com/?id.249509

vdb-entry

https://vuldb.com/?ctiid.249509

signaturepermissions-required

https://drive.google.com/file/d/147yg6oMHoJ1WvhH-TT0-GXDj...

exploit

CVSS V3.1

Score:

6.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

CVSS V3.0