CVE-2024-4966: SourceCodester SchoolWebTech home.php unrestricted upload
First published: Thu May 16 2024(Updated: )
A vulnerability was found in SourceCodester SchoolWebTech 1.0. It has been classified as critical. Affected is an unknown function of the file /improve/home.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264534 is the identifier assigned to this vulnerability.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SourceCodester SchoolWebTech | ||
| Sinamjackson Schoolwebtech | =1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4966?
CVE-2024-4966 has been classified as critical due to its potential for remote exploitation through unrestricted file uploads.
How do I fix CVE-2024-4966?
To fix CVE-2024-4966, it is essential to implement proper file upload validation and restrict file types in SourceCodester SchoolWebTech.
What impact does CVE-2024-4966 have on the system?
CVE-2024-4966 allows attackers to upload arbitrary files, potentially leading to further exploitation or server compromise.
Which version of SourceCodester SchoolWebTech is affected by CVE-2024-4966?
CVE-2024-4966 affects version 1.0 of SourceCodester SchoolWebTech.
Can CVE-2024-4966 be exploited remotely?
Yes, CVE-2024-4966 can be exploited remotely, making it a significant security concern.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- vendor/sourcecodester
- canonical/sourcecodester schoolwebtech
- vendor/sinamjackson
- canonical/sinamjackson schoolwebtech
- version/sinamjackson schoolwebtech/1.0