CVE-2024-6084 MEDIUM

CVE-2024-6084: itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload

Vendor Itsourcecode
Product Pool of Bethesda Online Reservation System
Weakness CWE-434 · Unrestricted file upload
Published June 18, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by this vulnerability is the function uploadImage of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268825 was assigned to this vulnerability.

Key dates

02Disclosure timeline

June 18, 2024 CVE published
August 1, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-0263 Unrestricted Upload of File with Dangerous Type in pimcore/pimcore CVE-2016-9492 PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types CVE-2025-9800 SimStudioAI sim HTML File route.ts import unrestricted upload CVE-2023-20196 CVE-2025-9216 StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload