Remote Code Execution Vulnerability in Wanxing Technology's Yitu Project Management Software
CVE-2024-24122
3.3LOW
What is CVE-2024-24122?
The vulnerability in Wanxing Technology's Yitu Project Management Software allows for remote code execution. Attackers can leverage the exp.adpx file as a zip compressed file, crafting a specific file name that enables them to decompress the project file into the system startup folder. Upon system restart, this can lead to the automatic execution of a malicious script embedded within the file, posing significant risks to system integrity and security.
References
CVSS V3.1
Score:
3.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved