Unrestricted File Upload Vulnerability in Gargaj Wuhu Slide Editor
CVE-2024-6948

9.8CRITICAL

Key Information:

Vendor
Gargaj
Status
Wuhu
Vendor
CVE Published:
21 July 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A significant vulnerability has been identified in the Gargaj Wuhu Slide Editor, located within the slideeditor.php file. This flaw permits unrestricted file uploads through manipulation of the 'newSlideFile' argument, enabling malicious actors to exploit the system remotely. As this vulnerability has been disclosed publicly, it poses an urgent threat, particularly in environments utilizing continuous delivery with rolling releases. Affected users should be aware of the risk and take swift action to safeguard their systems against potential attacks facilitated by this vulnerability.

Affected Version(s)

wuhu 3faad49bfcc3895e9ff76a591d05c8941273d120

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6948 - Proof of Concept

References

https://vuldb.com/?id.272070
vdb-entrytechnical-description
https://vuldb.com/?ctiid.272070
signaturepermissions-required
https://vuldb.com/?submit.374846
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database1 Proof of Concept(s)

Credit

Dee.Mirage (VulDB User)
.