Unrestricted File Upload Vulnerability in 07FLYCMS and 07FlyCRM
CVE-2024-9903
Key Information:
Badges
What is CVE-2024-9903?
A serious vulnerability has been discovered in the 07FLYCMS, 07FLY-CMS, and 07FlyCRM applications, where the fileUpload function located in the /admin/File/fileUpload endpoint allows attackers to upload files without proper restrictions. This flaw can be exploited remotely, enabling unauthorized users to upload malicious files. The use of this vulnerability poses a significant risk as it has been disclosed publicly, allowing potential attackers to leverage it for malicious purposes. The vendor has been unreachable for comments prior to the release of this information.
Affected Version(s)
07FLY-CMS 1.0
07FLY-CMS 1.1
07FLY-CMS 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.