CVE-2024-4306 CRITICAL

CVE-2024-4306: Unrestricted Upload of File with Dangerous Type vulnerability in HubBank

Vendor Ofofonobs

Product HubBank

Weakness CWE-434 · Unrestricted file upload

Published April 29, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution.

Key dates

02Disclosure timeline

April 29, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-4306 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-7075 BlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted upload CVE-2021-39147 XStream is vulnerable to an Arbitrary Code Execution attack CVE-2026-28270 Kiteworks Core has an Unrestricted Upload of File with Dangerous Type CVE-2025-11660 ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload CVE-2020-3436 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services File Upload Denial of Service Vulnerability