Unrestricted File Upload Vulnerability in Sage 1000 by Sage Group
CVE-2024-48646

8.1HIGH

Key Information:

Vendor

Sage Group

Status
Sage 1000
Vendor
CVE Published:
30 October 2024

What is CVE-2024-48646?

An Unrestricted File Upload vulnerability exists in Sage 1000 version 7.0.0, permitting authorized users to upload files without adequate validation. This flaw enables attackers to upload malicious files, such as HTML and scripts, which are capable of being executed on the server. The successful exploitation of this vulnerability could lead to system compromise, ultimately endangering the integrity and confidentiality of the system and its data.

References

https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/ma...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.