CVE-2024-8164

Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted upload

CVSS 5.3 MEDIUMEPSS 0.5%CWE-284 CWE-434

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Aug 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument new_name causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.6.0 is able to mitigate this issue. The affected component should be upgraded.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

Chengdu Everbrite Network Technology · BeikeShop

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/DeepMountains/zzz/blob/main/CVE4-2.md https://vuldb.com/?ctiid.275762 https://vuldb.com/?id.275762 https://vuldb.com/?submit.393375