CVE-2024-9855: 07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule_1 uploadFile unrestricted upload
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFile of the file /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule1 of the component Module Plug-In Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9855?
CVE-2024-9855 has been declared as critical.
How do I fix CVE-2024-9855?
To fix CVE-2024-9855, it is recommended to update to the latest version of 07FLYCMS, 07FLY-CMS, or 07FlyCRM that addresses this vulnerability.
What components are affected by CVE-2024-9855?
CVE-2024-9855 affects the uploadFile function within the Module Plug-In Handler of the mentioned software.
What software versions are impacted by CVE-2024-9855?
CVE-2024-9855 impacts 07FLYCMS, 07FLY-CMS, and 07FlyCRM, specifically version 1.3.8.
Is there an exploit available for CVE-2024-9855?
The details on exploits for CVE-2024-9855 are not specified, but it is advisable to monitor security advisories for any public exploit information.