CVE-2024-9855 07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule_1 uploadFile unrestricted upload

Medium 5.1 Published 11 Oct 2024 Updated 11 Oct 2024

Attackers can upload malicious files via the unrestricted uploadFile function in 07FLY CMS, potentially leading to remote code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-9855?

CVE-2024-9855 is a medium-severity vulnerability in 07FLY-CMS, published on 11 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFile of the file /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule_1 of the component Module Plug-In Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.

Weakness: CWE-434

Which versions are affected by CVE-2024-9855?

It affects 2 products.

Products include 07fly 07flycms, 07fly Customer Relationship Management.

How do I fix CVE-2024-9855?

No fix has been published for CVE-2024-9855 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-9855 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9855 exists.

Sources

Also known as GHSA-7hcw-752h-p5pp.