CVE-2024-0352 HIGH

CVE-2024-0352: Likeshop HTTP POST Request File.php userFormImage unrestricted upload

Vendor N/A
Product Likeshop
Weakness CWE-434 · Unrestricted file upload
Published January 9, 2024
Last update June 3, 2025
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250120.

Key dates

02Disclosure timeline

January 9, 2024 CVE published
June 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-22393 Apache Answer: Pixel Flood Attack by uploading the large pixel file CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability CVE-2026-1742 EFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted upload CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file CVE-2023-49815 WordPress WappPress plugin <= 5.0.3 - Unauthenticated Arbitrary File Upload vulnerability