{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-2754","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2024-03-21T01:58:05.896Z","datePublished":"2024-03-21T07:00:08.978Z","dateUpdated":"2024-08-01T19:25:41.660Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2024-03-21T07:00:08.978Z"},"title":"SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-434","lang":"en","description":"CWE-434 Unrestricted Upload"}]}],"affected":[{"vendor":"SourceCodester","product":"Complete E-Commerce Site","versions":[{"version":"1.0","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in SourceCodester Complete E-Commerce Site 1.0 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /admin/users_photo.php. Dank Manipulation des Arguments photo mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":4.7,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.7,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P"}}],"timeline":[{"time":"2024-03-21T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-03-21T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-03-21T03:03:17.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Shuning Yue (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.257544","name":"VDB-257544 | SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.257544","name":"VDB-257544 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://github.com/wkeyi0x1/vul-report/issues/4","tags":["exploit","issue-tracking"]}]},"adp":[{"affected":[{"vendor":"sourcecodester","product":"complete_ecommerce_site","cpes":["cpe:2.3:a:sourcecodester:complete_ecommerce_site:1.0:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-08T19:37:09.919658Z","id":"CVE-2024-2754","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-07-22T18:13:55.194Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-01T19:25:41.660Z"},"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.257544","name":"VDB-257544 | SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.257544","name":"VDB-257544 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"]},{"url":"https://github.com/wkeyi0x1/vul-report/issues/4","tags":["exploit","issue-tracking","x_transferred"]}]}]}}