Unrestricted File Upload Vulnerability in 07FLYCMS and Associated Products
CVE-2024-9904
Key Information:
Badges
What is CVE-2024-9904?
A severe vulnerability has been identified in the file upload functionality of 07FLYCMS, 07FLY-CMS, and 07FlyCRM up to version 1.2.0. This flaw, located at /admin/File/pictureUpload, allows attackers to manipulate the 'file' parameter leading to unrestricted file uploads. Consequently, this vulnerability could be leveraged by malicious users to execute arbitrary commands on the server, potentially leading to severe data breaches or system compromises. Since the exploit has been publicly disclosed, it is critical for users of these products to apply necessary security measures immediately to mitigate risk.
Affected Version(s)
07FLY-CMS 1.0
07FLY-CMS 1.1
07FLY-CMS 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.