CVE-2024-7910CWE-434

CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload

Medium · published August 18, 2024

CVSS v4.0
5.1
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00638 · 49.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-08-18T18:31Z
EPSS history
Timeline
  • 18 AUG 18:31Z
    CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload
    cvelistv5