Unrestricted File Upload Vulnerability in CodeAstro Membership Management System
CVE-2024-25869

8.8HIGH

Key Information:

Vendor

CodeAstro

Status
Membership Management System
Vendor
CVE Published:
28 February 2024

What is CVE-2024-25869?

The CodeAstro Membership Management System in PHP v.1.0 is susceptible to an Unrestricted File Upload vulnerability. This flaw allows remote attackers to upload malicious PHP files, which can then be executed to run arbitrary code on the server. The vulnerability is found in the settings.php component of the system, posing a significant risk if exploited. Organizations using this software should take immediate measures to protect against unauthorized file uploads to safeguard their server environments.

References

https://github.com/0xQRx/VulnerabilityResearch/blob/maste...

EPSS Score

56% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.