07FLYCMS Unrestricted File Upload Vulnerability (CVE-2024-9903)

Key Information Vulnerability Description Vulnerability Name: 07FLYCMS/07FLY-CMS/07FLYCRM UP TO 1.2.0 /ADMIN/FILE/FILEUPLOAD FILE UNRESTRICTED UPLOAD CVSS Meta Temp Score: 4.5 Current Exploit Price: $0-$5k CTI Interest Score: 1.10 Vulnerability Impact Affected Products: 07FLYCMS, 07FLY-CMS, 07FLYCRM up to 1.2.0 Vulnerability Description: This vulnerability affects the file upload functionality, allowing attackers to upload or transfer dangerous file types that can be automatically processed within the product environment. Impact Scope: Confidentiality, Integrity, and Availability. Vulnerability Details CWE ID: CWE-434 Vulnerability Type: File Upload Vulnerability Attack Vector: Remote Exploit Difficulty: Easy Technical Details: Publicly Available Exploit Tools: Publicly Available Attack Technique: T1608.002 (According to MITRE ATT&CK Framework) Vulnerability Exploitation Exploitation Method: Triggering the vulnerability by uploading malicious files Exploit Tools: Publicly available PoC tools Exploit Difficulty: Easy Exploitation Requirements: Requires additional authentication level Vulnerability Impact Impact Scope: Confidentiality, Integrity, and Availability Impact Severity: Medium Vulnerability Remediation Recommendation: Use alternative products Related Vulnerabilities: VDB-247901 and VDB-278662 Other Information CVE ID: CVE-2024-9903 Disclosure Date: 2024 Disclosure Platform: github.com Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available Disclosure Level: Public Disclosure Tools: Publicly available PoC tools Disclosure Exploits: Publicly available

Goal Reached Thanks to every supporter — we hit 100%!

07FLYCMS Unrestricted File Upload Vulnerability (CVE-2024-9903)