CVE-2024-24393

File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request

Critical · published February 8, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
67.0
In the wild
Unconfirmed
What it is

🚨 A single malicious POST request can turn your server into a playground for attackers! 🔥 Think of this vulnerability like a sneaky delivery person who can drop off any package at your front door without checking what’s inside — if you’re not watching closely, they could leave something dangerous! If exploited, an attacker could execute arbitrary code on your server, leading to unauthorized access and control over your system. This is absolutely devastating, as they could steal data, modify files, or even take down your entire service. Your users’ trust and your server’s integrity are at serious risk!

Put simply

Think of this vulnerability like a sneaky delivery person who can drop off any package at your front door without checking what’s inside — if you’re not watching closely, they could leave something dangerous! This vulnerability in Pichome v.1.1.01 allows attackers to upload crafted files that execute arbitrary code due to inadequate validation of uploaded content in the index.php file.

What to do

If exploited, an attacker could execute arbitrary code on your server, leading to unauthorized access and control over your system. This is absolutely devastating, as they could steal data, modify files, or even take down your entire service. Your users’ trust and your server’s integrity are at serious risk! To safeguard your system, immediately update to the latest version of Pichome, which includes critical patches. Additionally, implement strict validation and sanitization of uploaded files to prevent future exploits. Conduct a thorough security review to ensure there are no other vulnerabilities lurking! You've got this! With these actions, you can fortify your defenses and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01165 · 67.0th percentile
Published
2024-02-08T00:00Z
EPSS history
Timeline
  • 08 FEB 00:00Z
    File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request
    cvelistv5