CVE-2024-57170

MEDIUM

6.5

Descripcion

SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado3/18/2025

Ultima modificacion4/2/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

soplanning:soplanning

Debilidades (CWE)

CWE-22

Referencias

https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion(cve@mitre.org)

https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.