CVE-2024-57170

MEDIUM

6.5

Descricao

SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality.

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado3/18/2025

Ultima modificacao4/2/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

soplanning:soplanning

Fraquezas (CWE)

CWE-22

Referencias

https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion(cve@mitre.org)

https://themcsam.github.io/posts/so-planing-vulnerabilities/#arbitrary-file-deletion(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.