Remote Unrestricted Upload Vulnerability found in Codezips Online Shopping Portal 1.0

CVE-2024-9038

What is CVE-2024-9038?

A security flaw has been identified in the Codezips Online Shopping Portal version 1.0, specifically involving an insecure functionality within the insert-product.php file. The vulnerability arises from improper handling of the arguments productimage1, productimage2, and productimage3, which permits an attacker to upload files without restrictions. This weakness can be exploited remotely, allowing unauthorized users to upload potentially malicious files to the server, heightening the risk of further attacks. The exploit details have been made public, prompting stakeholders to take immediate action.

References