We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-4904

Byzoro Smart S200 Management Platform userattestation.php unrestricted upload



AssignerVulDB
Reserved2024-05-15
Published2024-05-15
Updated2024-08-01

Description

EN DE

A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264437 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Eine Schwachstelle wurde in Byzoro Smart S200 Management Platform bis 20240507 ausgemacht. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /useratte/userattestation.php. Durch Manipulieren des Arguments web_img mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.



MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
MEDIUM: 6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.5CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P

Product status

20240507
affected

Timeline

2024-05-15:Advisory disclosed
2024-05-15:VulDB entry created
2024-05-15:VulDB entry last update

Credits

Hefei-Coffee (VulDB User) reporter

References

https://vuldb.com/?id.264437 (VDB-264437 | Byzoro Smart S200 Management Platform userattestation.php unrestricted upload) vdb-entry technical-description

https://vuldb.com/?ctiid.264437 (VDB-264437 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

https://vuldb.com/?submit.330636 (Submit #330636 | Beijing Baizhuo Network Technology Co., LTD Smart S200 management platform S200 files upload) third-party-advisory

https://github.com/Hefei-Coffee/cve/blob/main/upload.md exploit

cve.org CVE-2024-4904

nvd.nist.gov CVE-2024-4904

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4904
Subscribe to our newsletter to learn more about our work.