CVE-2024-0185 RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload

Medium 4.7 Published 2 Jan 2024 Updated 14 Nov 2024

Remote attackers can upload malicious files via the avatar handler, potentially leading to code execution on the server.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-0185?

CVE-2024-0185 is a medium-severity vulnerability in RRJ Nueva Ecija Engineer Online Portal, published on 2 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file dasboard_teacher.php of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249443.

Weakness: CWE-434

Which versions are affected by CVE-2024-0185?

It affects 1 product.

Products include Nia Rrj Nueva Ecija Engineer Online Portal.

How do I fix CVE-2024-0185?

No fix has been published for CVE-2024-0185 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-0185 being exploited?

There is no known exploitation of CVE-2024-0185 in the wild and no public exploit code.

Sources

Also known as GHSA-26mj-5qc9-44g4.