A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes.
History

Tue, 19 Nov 2024 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Mayurik
Mayurik best Employee Management System
CPEs cpe:2.3:a:mayurik:best_employee_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Mayurik
Mayurik best Employee Management System

Thu, 14 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester best Employee Management System
CPEs cpe:2.3:a:sourcecodester:best_employee_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester best Employee Management System
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 14 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes.
Title SourceCodester Best Employee Management System profile.php unrestricted upload
Weaknesses CWE-284
CWE-434
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-11-14T16:00:15.245Z

Updated: 2024-11-14T17:04:42.105Z

Reserved: 2024-11-14T08:09:15.594Z

Link: CVE-2024-11214

cve-icon Vulnrichment

Updated: 2024-11-14T17:04:36.617Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-14T16:15:18.707

Modified: 2024-11-19T15:38:59.060

Link: CVE-2024-11214

cve-icon Redhat

No data.