CVE-2020-24203 - Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution

Back Back to CVE browser

CRITICAL

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution

Published Aug 27, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 3.74%

Description

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-425

CWE-434

Unrestricted Upload of File

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-16938
Advisory
https://github.com/hyd3sec/TravelManagementSystemRCE
x_refsource_MISCExploitThird Party Advisory
https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-16938		Advisory
https://github.com/hyd3sec/TravelManagementSystemRCE		x_refsource_MISCExploitThird Party Advisory
https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/		x_refsource_MISCExploitThird Party Advisory