Webopac from Grand Vice Info Pwnt! Blessed by Remote Attackers
CVE-2024-11017

8.8HIGH

Key Information:

Vendor

Grand Vice Info

Status
Webopac
Vendor
CVE Published:
11 November 2024

What is CVE-2024-11017?

The Webopac application developed by Grand Vice Info has a security flaw related to file upload mechanisms. This vulnerability arises from improper validation of file types, enabling remote attackers with standard privileges to upload potentially harmful files, such as webshells. Once these files are executed, attackers can gain unauthorized access to the server, leading to arbitrary code execution and possible compromise of sensitive data.

Affected Version(s)

Webopac 6 < 6.5.1

Webopac 7 < 7.2.3

References

https://www.twcert.org.tw/tw/cp-132-8211-a2da2-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-8212-a7d3a-2.html
third-party-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-11017 : Webopac from Grand Vice Info Pwnt! Blessed by Remote Attackers