CVE-2024-34990 File upload in n/a
Authenticated customers can upload PHP files to a predictable path, enabling remote code execution on the PrestaShop server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-34990?
CVE-2024-34990 is a critical vulnerability in n/a, published on 19 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.
Weakness: CWE-434
Which versions are affected by CVE-2024-34990?
How do I fix CVE-2024-34990?
No fix has been published for CVE-2024-34990 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-34990 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34990 exists.
Sources
Also known as GHSA-vcqg-q2pp-ch79.