Unrestricted File Upload Vulnerability in Online Railway Reservation System
CVE-2024-7910

7.2HIGH

Key Information:

Vendor

CodeAstro

Status
Online Railway Reservation System
Vendor
CVE Published:
18 August 2024

What is CVE-2024-7910?

The CodeAstro Online Railway Reservation System 1.0 contains a vulnerability within the Profile Photo Update Handler located at /admin/emp-profile-avatar.php. This flaw allows for unrestricted file uploads, which can be exploited by attackers to upload malicious files. The manipulation can be conducted remotely, posing a significant security risk as it may lead to unauthorized access or system compromise. This vulnerability has been publicly disclosed and is of critical concern for any users of the affected system.

References

https://vuldb.com/?id.275036
https://vuldb.com/?ctiid.275036
https://vuldb.com/?submit.391650

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.