Critical · published November 26, 2024
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 Unauthenticated access is a serious concern here! ProjectSend versions prior to r1720 have a vulnerability that lets attackers send crafted HTTP requests to options.php, pulling some sneaky moves to modify your app's configuration. 🔥 Think of it like a restaurant without a proper check-in process — anyone can just walk in and start rearranging the tables, or worse, bring in their own food and impose their menu! This vulnerability allows attackers to slip in unnoticed and change things to their liking. If exploited, an attacker could create accounts at will, upload webshells, or even inject malicious JavaScript. This is absolutely devastating – your application could become a playground for cybercriminals, making your system vulnerable to further attacks and data breaches.
Think of it like a restaurant without a proper check-in process — anyone can just walk in and start rearranging the tables, or worse, bring in their own food and impose their menu! This vulnerability allows attackers to slip in unnoticed and change things to their liking. This improper authentication vulnerability allows remote, unauthenticated attackers to send specially crafted HTTP requests to options.php, bypassing authentication mechanisms and allowing unauthorized access to critical configuration features.
If exploited, an attacker could create accounts at will, upload webshells, or even inject malicious JavaScript. This is absolutely devastating – your application could become a playground for cybercriminals, making your system vulnerable to further attacks and data breaches. Urgently upgrade ProjectSend to version r1720 or later. Review access controls and audit your configurations for any unauthorized changes. Regularly monitor your logs for any suspicious activity. 🔥 You've got this! Follow these steps, and you'll be back in control with your security hero status activated! 🛡️