CVE-2024-8707 - Vulnerability Details

Vendors	Products
Yunknet	Yunke Online School System

Link	Providers
https://vuldb.com/?ctiid.277216
https://vuldb.com/?id.277216
https://vuldb.com/?submit.402917
https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade

Type	Values Removed	Values Added
First Time appeared		Yunknet Yunknet yunke Online School System
CPEs		cpe:2.3:a:yunknet:yunke_online_school_system::::::::
Vendors & Products		Yunknet Yunknet yunke Online School System
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title		云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal
Weaknesses		CWE-22
References		https://vuldb.com/?ctiid.277216 https://vuldb.com/?id.277216 https://vuldb.com/?submit.402917 https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8707", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-09-11T16:30:24.126Z", "datePublished": "2024-09-12T00:31:27.276Z", "dateUpdated": "2024-09-12T14:34:37.102Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-12T00:31:27.276Z"}, "title": "\u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System Appadmin.php downfile path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Path Traversal"}]}], "affected": [{"vendor": "\u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "product": "Yunke Online School System", "versions": [{"version": "3.0.0", "status": "affected"}, {"version": "3.0.1", "status": "affected"}, {"version": "3.0.2", "status": "affected"}, {"version": "3.0.3", "status": "affected"}, {"version": "3.0.4", "status": "affected"}, {"version": "3.0.5", "status": "affected"}, {"version": "3.0.6", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "In \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System bis 3.0.6 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft die Funktion downfile der Datei application/admin/controller/Appadmin.php. Mittels dem Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "timeline": [{"time": "2024-09-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-09-11T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-09-11T18:35:33.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wiki (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.277216", "name": "VDB-277216 | \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System Appadmin.php downfile path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.277216", "name": "VDB-277216 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.402917", "name": "Submit #402917 | \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System <=v3.0.6 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade", "tags": ["broken-link", "exploit"]}]}, "adp": [{"affected": [{"vendor": "yunknet", "product": "yunke_online_school_system", "cpes": ["cpe:2.3:a:yunknet:yunke_online_school_system:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.0", "status": "affected"}, {"version": "3.0.1", "status": "affected"}, {"version": "3.0.2", "status": "affected"}, {"version": "3.0.3", "status": "affected"}, {"version": "3.0.4", "status": "affected"}, {"version": "3.0.5", "status": "affected"}, {"version": "3.0.6", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-12T14:32:16.671723Z", "id": "CVE-2024-8707", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T14:34:37.102Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-8707 (string)

assignerOrgId : 1af790b2-7ee1-4545-860a-a788eba489b5 (string)

state : PUBLISHED (string)

assignerShortName : VulDB (string)

dateReserved : 2024-09-11T16:30:24.126Z (string)

datePublished : 2024-09-12T00:31:27.276Z (string)

dateUpdated : 2024-09-12T14:34:37.102Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 1af790b2-7ee1-4545-860a-a788eba489b5 (string)

shortName : VulDB (string)

dateUpdated : 2024-09-12T00:31:27.276Z (string)

}

title : 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-22 (string)

lang : en (string)

description : CWE-22 Path Traversal (string)

}

]

}

]

affected : [ »

0 : { »

vendor : 云课网络科技有限公司 (string)

product : Yunke Online School System (string)

versions : [ »

0 : { »

version : 3.0.0 (string)

status : affected (string)

}

1 : { »

version : 3.0.1 (string)

status : affected (string)

}

2 : { »

version : 3.0.2 (string)

status : affected (string)

}

3 : { »

version : 3.0.3 (string)

status : affected (string)

}

4 : { »

version : 3.0.4 (string)

status : affected (string)

}

5 : { »

version : 3.0.5 (string)

status : affected (string)

}

6 : { »

version : 3.0.6 (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. (string)

}

1 : { »

lang : de (string)

value : In 云课网络科技有限公司 Yunke Online School System bis 3.0.6 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft die Funktion downfile der Datei application/admin/controller/Appadmin.php. Mittels dem Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. (string)

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

version : 4.0 (string)

baseScore : 5.3 (number)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (string)

baseSeverity : MEDIUM (string)

}

1 : { »

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 4.3 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

baseSeverity : MEDIUM (string)

}

2 : { »

cvssV3_0 : { »

version : 3.0 (string)

baseScore : 4.3 (number)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

baseSeverity : MEDIUM (string)

}

3 : { »

cvssV2_0 : { »

version : 2.0 (string)

baseScore : 4 (number)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

}

]

timeline : [ »

0 : { »

time : 2024-09-11T00:00:00.000Z (string)

lang : en (string)

value : Advisory disclosed (string)

}

1 : { »

time : 2024-09-11T02:00:00.000Z (string)

lang : en (string)

value : VulDB entry created (string)

}

2 : { »

time : 2024-09-11T18:35:33.000Z (string)

lang : en (string)

value : VulDB entry last update (string)

}

]

credits : [ »

0 : { »

lang : en (string)

value : wiki (VulDB User) (string)

type : reporter (string)

}

]

references : [ »

0 : { »

url : https://vuldb.com/?id.277216 (string)

name : VDB-277216 | 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal (string)

tags : [ »

0 : vdb-entry (string)

1 : technical-description (string)

]

}

1 : { »

url : https://vuldb.com/?ctiid.277216 (string)

name : VDB-277216 | CTI Indicators (IOB, IOC, TTP, IOA) (string)

tags : [ »

0 : signature (string)

1 : permissions-required (string)

]

}

2 : { »

url : https://vuldb.com/?submit.402917 (string)

name : Submit #402917 | 云课网络科技有限公司 Yunke Online School System <=v3.0.6 Path Traversal (string)

tags : [ »

0 : third-party-advisory (string)

]

}

3 : { »

url : https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade (string)

tags : [ »

0 : broken-link (string)

1 : exploit (string)

]

}

]

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : yunknet (string)

product : yunke_online_school_system (string)

cpes : [ »

0 : cpe:2.3:a:yunknet:yunke_online_school_system:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 3.0.0 (string)

status : affected (string)

}

1 : { »

version : 3.0.1 (string)

status : affected (string)

}

2 : { »

version : 3.0.2 (string)

status : affected (string)

}

3 : { »

version : 3.0.3 (string)

status : affected (string)

}

4 : { »

version : 3.0.4 (string)

status : affected (string)

}

5 : { »

version : 3.0.5 (string)

status : affected (string)

}

6 : { »

version : 3.0.6 (string)

status : affected (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-12T14:32:16.671723Z (string)

id : CVE-2024-8707 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-12T14:34:37.102Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8707", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-12T14:32:16.671723Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:yunknet:yunke_online_school_system:*:*:*:*:*:*:*:*"], "vendor": "yunknet", "product": "yunke_online_school_system", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.0.6"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T14:34:25.338Z"}}], "cna": {"title": "\u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System Appadmin.php downfile path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "wiki (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}], "affected": [{"vendor": "\u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "product": "Yunke Online School System", "versions": [{"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.1"}, {"status": "affected", "version": "3.0.2"}, {"status": "affected", "version": "3.0.3"}, {"status": "affected", "version": "3.0.4"}, {"status": "affected", "version": "3.0.5"}, {"status": "affected", "version": "3.0.6"}]}], "timeline": [{"lang": "en", "time": "2024-09-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-09-11T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-09-11T18:35:33.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.277216", "name": "VDB-277216 | \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System Appadmin.php downfile path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.277216", "name": "VDB-277216 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.402917", "name": "Submit #402917 | \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System <=v3.0.6 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade", "tags": ["broken-link", "exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "In \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System bis 3.0.6 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft die Funktion downfile der Datei application/admin/controller/Appadmin.php. Mittels dem Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-12T00:31:27.276Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8707", "state": "PUBLISHED", "dateUpdated": "2024-09-12T14:34:37.102Z", "dateReserved": "2024-09-11T16:30:24.126Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-09-12T00:31:27.276Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-8707 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-12T14:32:16.671723Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:yunknet:yunke_online_school_system:*:*:*:*:*:*:*:* (string)

]

vendor : yunknet (string)

product : yunke_online_school_system (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.0.0 (string)

}

1 : { »

status : affected (string)

version : 3.0.1 (string)

}

2 : { »

status : affected (string)

version : 3.0.2 (string)

}

3 : { »

status : affected (string)

version : 3.0.3 (string)

}

4 : { »

status : affected (string)

version : 3.0.4 (string)

}

5 : { »

status : affected (string)

version : 3.0.5 (string)

}

6 : { »

status : affected (string)

version : 3.0.6 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-12T14:34:25.338Z (string)

}

]

cna : { »

title : 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal (string)

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : wiki (VulDB User) (string)

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

version : 4.0 (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (string)

}

1 : { »

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

}

2 : { »

cvssV3_0 : { »

version : 3.0 (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

}

3 : { »

cvssV2_0 : { »

version : 2.0 (string)

baseScore : 4 (number)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

}

]

affected : [ »

0 : { »

vendor : 云课网络科技有限公司 (string)

product : Yunke Online School System (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.0.0 (string)

}

1 : { »

status : affected (string)

version : 3.0.1 (string)

}

2 : { »

status : affected (string)

version : 3.0.2 (string)

}

3 : { »

status : affected (string)

version : 3.0.3 (string)

}

4 : { »

status : affected (string)

version : 3.0.4 (string)

}

5 : { »

status : affected (string)

version : 3.0.5 (string)

}

6 : { »

status : affected (string)

version : 3.0.6 (string)

}

]

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2024-09-11T00:00:00.000Z (string)

value : Advisory disclosed (string)

}

1 : { »

lang : en (string)

time : 2024-09-11T02:00:00.000Z (string)

value : VulDB entry created (string)

}

2 : { »

lang : en (string)

time : 2024-09-11T18:35:33.000Z (string)

value : VulDB entry last update (string)

}

]

references : [ »

0 : { »

url : https://vuldb.com/?id.277216 (string)

name : VDB-277216 | 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal (string)

tags : [ »

0 : vdb-entry (string)

1 : technical-description (string)

]

}

1 : { »

url : https://vuldb.com/?ctiid.277216 (string)

name : VDB-277216 | CTI Indicators (IOB, IOC, TTP, IOA) (string)

tags : [ »

0 : signature (string)

1 : permissions-required (string)

]

}

2 : { »

url : https://vuldb.com/?submit.402917 (string)

name : Submit #402917 | 云课网络科技有限公司 Yunke Online School System <=v3.0.6 Path Traversal (string)

tags : [ »

0 : third-party-advisory (string)

]

}

3 : { »

url : https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade (string)

tags : [ »

0 : broken-link (string)

1 : exploit (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. (string)

}

1 : { »

lang : de (string)

value : In 云课网络科技有限公司 Yunke Online School System bis 3.0.6 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft die Funktion downfile der Datei application/admin/controller/Appadmin.php. Mittels dem Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-22 (string)

description : CWE-22 Path Traversal (string)

}

]

}

]

providerMetadata : { »

orgId : 1af790b2-7ee1-4545-860a-a788eba489b5 (string)

shortName : VulDB (string)

dateUpdated : 2024-09-12T00:31:27.276Z (string)

}

cveMetadata : { »

cveId : CVE-2024-8707 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-12T14:34:37.102Z (string)

dateReserved : 2024-09-11T16:30:24.126Z (string)

assignerOrgId : 1af790b2-7ee1-4545-860a-a788eba489b5 (string)

datePublished : 2024-09-12T00:31:27.276Z (string)

assignerShortName : VulDB (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in \u4e91\u8bfe\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en ?????????? Yunke Online School System hasta la versi\u00f3n 3.0.6. Se ha declarado como problem\u00e1tica. Esta vulnerabilidad afecta a la funci\u00f3n downfile del archivo application/admin/controller/Appadmin.php. La manipulaci\u00f3n del argumento url provoca un path traversal. El ataque se puede iniciar de forma remota. El exploit se ha hecho p\u00fablico y puede utilizarse."}], "id": "CVE-2024-8707", "lastModified": "2024-09-12T15:18:27.333", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "LOW", "vulnerableSystemIntegrity": "NONE"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2024-09-12T01:15:10.110", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.277216"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.277216"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.402917"}, {"source": "cna@vuldb.com", "url": "https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. (string)

}

1 : { »

lang : es (string)

value : Se ha encontrado una vulnerabilidad en ?????????? Yunke Online School System hasta la versión 3.0.6. Se ha declarado como problemática. Esta vulnerabilidad afecta a la función downfile del archivo application/admin/controller/Appadmin.php. La manipulación del argumento url provoca un path traversal. El ataque se puede iniciar de forma remota. El exploit se ha hecho público y puede utilizarse. (string)

}

]

id : CVE-2024-8707 (string)

lastModified : 2024-09-12T15:18:27.333 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : cna@vuldb.com (string)

type : Secondary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : cna@vuldb.com (string)

type : Secondary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : LOW (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : LOW (string)

vulnerableSystemIntegrity : NONE (string)

}

source : cna@vuldb.com (string)

type : Secondary (string)

}

]

}

published : 2024-09-12T01:15:10.110 (string)

references : [ »

0 : { »

source : cna@vuldb.com (string)

url : https://vuldb.com/?ctiid.277216 (string)

}

1 : { »

source : cna@vuldb.com (string)

url : https://vuldb.com/?id.277216 (string)

}

2 : { »

source : cna@vuldb.com (string)

url : https://vuldb.com/?submit.402917 (string)

}

3 : { »

source : cna@vuldb.com (string)

url : https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade (string)

}

]

sourceIdentifier : cna@vuldb.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : cna@vuldb.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object