CVE-2024-9904: 07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload
First published: Sun Oct 13 2024(Updated: )
A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 07FLYCMS | <1.2.0 | |
| 07FLY-CMS | <1.2.0 | |
| 07FLYCMS | <1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9904?
CVE-2024-9904 is classified as a critical vulnerability.
How does CVE-2024-9904 impact affected systems?
CVE-2024-9904 allows for unrestricted file upload due to manipulation of the argument in the pictureUpload function.
Which software versions are affected by CVE-2024-9904?
CVE-2024-9904 affects 07FLYCMS, 07FLY-CMS, and 07FlyCRM up to version 1.2.0.
How do I fix CVE-2024-9904?
To mitigate CVE-2024-9904, upgrade to a version of the affected products that is above 1.2.0.
What is the nature of the vulnerability described in CVE-2024-9904?
The vulnerability in CVE-2024-9904 involves a flaw in the file upload functionality that can be exploited to upload arbitrary files.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/07flycms
- canonical/07flycms
- canonical/07fly-cms