Unrestricted File Upload Vulnerability in Codezips Tourist Management System
CVE-2024-9816
Key Information:
- Vendor
Codezips
- Vendor
- CVE Published:
- 10 October 2024
Badges
What is CVE-2024-9816?
A critical vulnerability has been identified in Codezips's Tourist Management System version 1.0, specifically affecting the functionality associated with the /admin/change-image.php endpoint. This issue arises from an improper validation of file uploads, allowing attackers to bypass permissions and upload malicious files without restriction. The vulnerability can be exploited remotely, enabling a potentially devastating impact on system integrity and data security. As this exploit has been publicly disclosed, users and administrators are strongly urged to apply security patches and monitor their systems closely for any signs of exploitation.
Affected Version(s)
Tourist Management System 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.