Login Request a demo
High severity · published Aug 18, 2024
CVE-2024-7910
CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
Online Railway Reservation System · CodeAstro
1.0 · source: vendor, NVD, CISA
Affected product
OR
Online Railway Reservation System
CodeAstro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7910
Exploit
https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md
Permissions Required
https://vuldb.com/?ctiid.275036
Permissions Required
https://vuldb.com/?id.275036
Third Party Advisory
https://vuldb.com/?submit.391650
More from Online Railway Reservation System
6.1
CVE-2024-0782
CodeAstro Online Railway Reservation System pass-profile.php cross site scripting
5.3
CVE-2024-7912
CodeAstro Online Railway Reservation System assets exposure of information through directory listing
4.8
CVE-2024-7815
CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
4.8
CVE-2024-7814
CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scripting