Vulnerability · Published Jun 7, 2024 · Assigned by VulDB
CVE-2024-5745itsourcecode Bakery Online Ordering System unrestricted upload
High 7.3
In plain English
A high-severity unrestricted file upload in Bakery Online Ordering System from itsourcecode. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-267414 is the identifier assigned to this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| itsourcecode | Bakery Online Ordering System | 1.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- VDB-267414 | itsourcecode Bakery Online Ordering System unrestricted upload vdb-entry, technical-description
- VDB-267414 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #351827 | itsourcecode Bakery Online Ordering System Using PHP and MySQL Database V1.0 Unrestricted Upload third-party-advisory
- https://github.com/L1OudFd8cl09/CVE/blob/main/07_06_2024_a.md exploit