CVE-2024-4500: SourceCodester Prison Management System edit-photo.php unrestricted upload
First published: Sun May 05 2024(Updated: )
A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Employee/edit-photo.php. The manipulation of the argument userImage leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263104.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prison Management System | =1.0 | |
| Prison Management System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4500?
CVE-2024-4500 is considered a critical vulnerability.
How does CVE-2024-4500 affect the SourceCodester Prison Management System?
CVE-2024-4500 allows for unrestricted file uploads via the userImage argument in the /Employee/edit-photo.php file.
What potential impact can occur from exploiting CVE-2024-4500?
Exploitation of CVE-2024-4500 could lead to unauthorized access and execution of malicious code on the affected system.
How do I fix CVE-2024-4500?
To fix CVE-2024-4500, ensure to validate and sanitize file uploads, restricting them to specific file types and sizes.
Are there any workarounds for CVE-2024-4500?
As a workaround for CVE-2024-4500, you may restrict access to the /Employee/edit-photo.php file until a patch is applied.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/last-modified-date
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/guess-ai
- vendor/fast5
- canonical/prison management system
- version/prison management system/1.0
- vendor/sourcecodester