CVE-2024-1008 — Unrestricted File Upload in Employee Management System

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
7.2HIGHNVD
CNA4.7
EPSS
0.1%
top 77.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Employee Management SystemRazormist Employee Management System
Timeline
PublishedJan 29

Description

A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252277 was assigned to this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload↗2024-01-29
▶
GHSA
GHSA-rpp9-fjv3-6cxw: A vulnerability was found in SourceCodester Employee Management System 1↗2024-01-29
▶
CVE-2024-1008 — Unrestricted File Upload | cvebase