CVE-2024-8940 CRITICAL

CVE-2024-8940: Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase

Vendor Scriptcase

Product Scriptcase

Weakness CWE-434 · Unrestricted file upload

Published September 24, 2024

Last update September 24, 2024

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input.

Key dates

02Disclosure timeline

September 24, 2024 CVE published

September 24, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-8940 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-7074 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution CVE-2023-5277 SourceCodester Engineers Online Portal student_avatar.php unrestricted upload CVE-2023-6827 Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-6900 code-projects Library System add-book.php unrestricted upload CVE-2025-10427 SourceCodester Pet Grooming Management Software user.php unrestricted upload