Kanboard vulnerability allows attackers to upload malicious SQLite database, triggering file download

CVE-2024-51747

What is CVE-2024-51747?

An authenticated admin within the Kanboard project management application can exploit a vulnerability that allows for unauthorized reading and deletion of files from the server. This occurs due to improper handling of file links stored in the SQLite database, specifically within the project_has_files table. When an attacker uploads a manipulated SQLite database file to Kanboard through a legitimate feature, they can create paths that lead to sensitive files being resolvable and downloadable. As a result, the attacker can trigger the download of files that are otherwise restricted by the application's permission model. To mitigate this risk, users are strongly advised to upgrade to version 1.2.42 or higher, as there are currently no workarounds available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References