CVE-2024-7910: medium-severity vulnerability in CodeAstro Online Railway Reservation System
CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.6%
A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
CodeAstro · Online Railway Reservation SystemRelated CVEs — CodeAstro Online Railway Reservation System
In the same product, most dangerous first.
CVE-2024-7815MEDIUMCodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scriptingEPSS 1.2%CVE-2024-7912MEDIUMCodeAstro Online Railway Reservation System assets exposure of information through directory listingEPSS 0.8%CVE-2024-0782LOWCodeAstro Online Railway Reservation System pass-profile.php cross site scriptingEPSS 0.6%CVE-2024-7814MEDIUMCodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scriptingEPSS 0.4%