CVE-2024-9985 Ragic Enterprise Cloud Database - Arbitrary File Upload
Attackers with regular privileges can upload a webshell to execute arbitrary code on the remote server due to improper file type validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9985?
CVE-2024-9985 is a critical vulnerability in Ragic Enterprise Cloud Database, published on 15 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server.
Weakness: CWE-434
Which versions are affected by CVE-2024-9985?
It affects 1 product.
Products include Ragic Enterprise Cloud Database.
How do I fix CVE-2024-9985?
No fix has been published for CVE-2024-9985 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-9985 being exploited?
There is no known exploitation of CVE-2024-9985 in the wild and no public exploit code.
Other vulnerabilities in Ragic Enterprise Cloud Database
- CVE-2024-9984 Ragic Enterprise Cloud Database - Missing Authentication
- CVE-2025-15016 Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key
- CVE-2025-15015 Ragic｜Enterprise Cloud Database - Arbitrary File Read
- CVE-2024-9983 Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal
- CVE-2023-41343 Ragic No-Code Database Builder - Stored XSS
Sources
Also known as GHSA-9jqp-827w-wpmw.