Critical severity · published Jan 2, 2024
CVE-2024-0194
CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted upload
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, has been found in CodeAstro Internet Banking System up to 1.0. This issue affects some unknown processing of the file pages_account.php of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249509 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Internet Banking System · CodeAstro
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0194
Exploit
https://drive.google.com/file/d/147yg6oMHoJ1WvhH-TT0-GXDjKyNCSoeX/view?usp=sharing
Third Party Advisory
https://vuldb.com/?ctiid.249509
Third Party Advisory
https://vuldb.com/?id.249509
More from Internet Banking System
9.8
CVE-2023-5693
CodeAstro Internet Banking System pages_reset_pwd.php sql injection
8.8
CVE-2025-29017
A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within…
7.3
CVE-2024-56924
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page…
6.1
CVE-2025-29015
Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php
6.1
CVE-2024-0781
CodeAstro Internet Banking System pages_client_signup.php redirect