CVE-2024-9904: 07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload
A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9904?
CVE-2024-9904 is classified as a critical vulnerability.
How does CVE-2024-9904 impact affected systems?
CVE-2024-9904 allows for unrestricted file upload due to manipulation of the argument in the pictureUpload function.
Which software versions are affected by CVE-2024-9904?
CVE-2024-9904 affects 07FLYCMS, 07FLY-CMS, and 07FlyCRM up to version 1.2.0.
How do I fix CVE-2024-9904?
To mitigate CVE-2024-9904, upgrade to a version of the affected products that is above 1.2.0.
What is the nature of the vulnerability described in CVE-2024-9904?
The vulnerability in CVE-2024-9904 involves a flaw in the file upload functionality that can be exploited to upload arbitrary files.