A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
History

Tue, 05 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Codezips
Codezips online Institute Management System
CPEs cpe:2.3:a:codezips:online_institute_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Codezips
Codezips online Institute Management System
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Mon, 04 Nov 2024 15:45:00 +0000

Type Values Removed Values Added
Description A vulnerability classified as critical has been found in Codezips Online Institute Management System 1.0. This affects an unknown part of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title Codezips Online Institute Management System save_user.php unrestricted upload
Weaknesses CWE-266
CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-11-04T15:31:04.401Z

Updated: 2024-11-05T15:24:52.251Z

Reserved: 2024-11-04T09:48:46.984Z

Link: CVE-2024-10764

cve-icon Vulnrichment

Updated: 2024-11-05T15:24:47.232Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-04T16:15:04.497

Modified: 2024-11-06T14:44:53.410

Link: CVE-2024-10764

cve-icon Redhat

No data.