CVE-2024-3112 Quotes and Tips < 1.45 - Admin+ Arbitrary File Upload
High-privilege users can upload arbitrary files due to insufficient validation, potentially leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3112?
CVE-2024-3112 is a medium-severity vulnerability in Unknown Quotes and Tips by BestWebSoft, published on 12 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Weakness: CWE-434
Which versions are affected by CVE-2024-3112?
It affects 1 product.
Products include Bestwebsoft Quotes and Tips.
How do I fix CVE-2024-3112?
No fix has been published for CVE-2024-3112 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3112 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3112 exists.
Other vulnerabilities in Unknown Quotes and Tips by BestWebSoft
Sources
Also known as GHSA-h7fj-9vcc-c7hx.