Unauthenticated Remote File Execution Vulnerability in Webopac
CVE-2024-11018

9.8CRITICAL

Key Information:

Vendor
Grand Vice Info
Status
Webopac
Vendor
CVE Published:
11 November 2024

Summary

The Webopac product by Grand Vice Info is susceptible to a vulnerability stemming from inadequate validation of uploaded file types. This weakness enables unauthenticated attackers to upload malicious files, such as webshells, thereby allowing them to execute arbitrary code on the server. This flaw poses a significant security risk, as it can compromise server integrity and lead to unauthorized access or manipulation of sensitive data.

Affected Version(s)

Webopac 6 < 6.5.1

Webopac 7 < 7.2.3

References

https://www.twcert.org.tw/tw/cp-132-8213-3413b-1.html
vendor-advisory
https://www.twcert.org.tw/en/cp-139-8214-64fa2-2.html
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.