{"id":"CVE-2024-3436","state":"PUBLISHED","title":"SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload","description":"A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability.","publishedAt":"2024-04-07T23:31:06.911Z","updatedAt":"2024-08-26T14:40:43.954Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Prison Management System"],"affected":[{"vendor":"SourceCodester","product":"Prison Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Avatar Handler"]}],"references":["https://vuldb.com/?id.259630","https://vuldb.com/?ctiid.259630","https://vuldb.com/?submit.311919","https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.md"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3436.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3436","state":"PUBLISHED","datePublished":"2024-04-07T23:31:06.911Z","dateUpdated":"2024-08-26T14:40:43.954Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-04-07T13:13:48.450Z"},"containers":{"cna":{"title":"SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload","descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability."},{"lang":"de","value":"In SourceCodester Prison Management System 1.0 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Es geht um eine nicht näher bekannte Funktion der Datei /Admin/edit-photo.php der Komponente Avatar Handler. Durch Manipulieren des Arguments avatar mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"SourceCodester","product":"Prison Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Avatar Handler"]}],"references":[{"url":"https://vuldb.com/?id.259630","name":"VDB-259630 | SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.259630","name":"VDB-259630 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.311919","name":"Submit #311919 | https://www.sourcecodester.com Prison Management System v1.0 remote command/code execute","tags":["third-party-advisory"]},{"url":"https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.md","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"CWE-434 Unrestricted Upload"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-04-07T23:31:06.911Z"},"timeline":[{"time":"2024-04-07T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-04-07T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-04-07T15:19:06.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"LI YU (VulDB User)","type":"reporter"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.259630","name":"VDB-259630 | SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.259630","name":"VDB-259630 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"]},{"url":"https://vuldb.com/?submit.311919","name":"Submit #311919 | https://www.sourcecodester.com Prison Management System v1.0 remote command/code execute","tags":["third-party-advisory","x_transferred"]},{"url":"https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.md","tags":["exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:12:06.902Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sourcecodester","product":"prison_management_system","defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:prison_management_system:1.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-26T14:40:12.629643Z","id":"CVE-2024-3436","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-26T14:40:43.954Z"}}]}}}