{"id":"CVE-2024-7495","state":"PUBLISHED","title":"itsourcecode Laravel Accounting System HomeController.php unrestricted upload","description":"A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273621 was assigned to this vulnerability.","publishedAt":"2024-08-06T01:00:10.350Z","updatedAt":"2024-08-07T20:46:35.885Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["itsourcecode Laravel Accounting System"],"affected":[{"vendor":"itsourcecode","product":"Laravel Accounting System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.273621","https://vuldb.com/?ctiid.273621","https://vuldb.com/?submit.385829","https://github.com/DeepMountains/Mirage/blob/main/CVE13-1.md"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7495.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7495","state":"PUBLISHED","datePublished":"2024-08-06T01:00:10.350Z","dateUpdated":"2024-08-07T20:46:35.885Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-08-05T15:39:09.871Z"},"containers":{"cna":{"title":"itsourcecode Laravel Accounting System HomeController.php unrestricted upload","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273621 was assigned to this vulnerability."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in itsourcecode Laravel Accounting System 1.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei app/Http/Controllers/HomeController.php. Durch das Manipulieren des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"itsourcecode","product":"Laravel Accounting System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.273621","name":"VDB-273621 | itsourcecode Laravel Accounting System HomeController.php unrestricted upload","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.273621","name":"VDB-273621 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.385829","name":"Submit #385829 | itsourcecode Laravel Accounting System v1.0 FileUpload","tags":["third-party-advisory"]},{"url":"https://github.com/DeepMountains/Mirage/blob/main/CVE13-1.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"CWE-434 Unrestricted Upload"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-08-06T01:00:10.350Z"},"timeline":[{"time":"2024-08-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-05T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-05T17:44:21.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Dee.Mirage (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-07T20:46:12.793373Z","id":"CVE-2024-7495","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-07T20:46:35.885Z"}}]}}}