High severity · published Apr 6, 2020
CVE-2020-11544
An issue was discovered in Project Worlds Official Car Rental System 1
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the upload section on the file-manager page contains an arbitrary file upload vulnerability via add_cars.php. There are no upload restrictions for executable files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Official Car Rental System · Projectworlds
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11544
Exploit
https://frostylabs.net/writeups/cve-2020-11544/
More from Official Car Rental System
9.8
CVE-2020-11545
Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters…