CVE-2024-31601 Code injection in n/a
Attackers can execute arbitrary code on the Panabit Panalog big data analysis platform via the exportpdf.php component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-31601?
CVE-2024-31601 is a critical code injection vulnerability in n/a, published on 26 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows attackers to execute arbitrary code via the exportpdf.php component.
Weakness: CWE-616
Which versions are affected by CVE-2024-31601?
How do I fix CVE-2024-31601?
No fix has been published for CVE-2024-31601 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-31601 being exploited?
There is no known exploitation of CVE-2024-31601 in the wild and no public exploit code.
Sources
Also known as GHSA-9wqc-q367-q634.