CVE-2024-2754: SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload
First published: Thu Mar 21 2024(Updated: )
A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SourceCodester Complete E-Commerce Site | ||
| Donbermoy Complete E-commerce Site | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2754?
CVE-2024-2754 has been classified as a critical vulnerability.
How does CVE-2024-2754 exploit the system?
CVE-2024-2754 allows attackers to perform unrestricted file uploads through manipulated arguments in the /admin/users_photo.php file.
Which software is affected by CVE-2024-2754?
CVE-2024-2754 affects the SourceCodester Complete E-Commerce Site version 1.0.
What are the potential consequences of CVE-2024-2754?
The exploitation of CVE-2024-2754 can lead to remote attacks that may compromise the server and expose sensitive data.
How can I mitigate the risks associated with CVE-2024-2754?
To mitigate CVE-2024-2754, users should implement strict validations on file uploads to restrict file types and sizes.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/event
- vendor/sourcecodester
- canonical/sourcecodester complete e-commerce site
- vendor/donbermoy
- canonical/donbermoy complete e-commerce site
- version/donbermoy complete e-commerce site/1.0