CVE-2024-6948

Gargaj wuhu Slide Editor slideeditor.php unrestricted upload

State: Published
Severity: 5.3 Medium
Published: Jul 21, 2024
Updated: Aug 1, 2024
Reserved: Jul 20, 2024

Description

A vulnerability classified as critical has been found in Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120. Affected is an unknown function of the file /slideeditor.php of the component Slide Editor. The manipulation of the argument newSlideFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-272070 is the identifier assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-434 Unrestricted Upload

Affected Products

Product	Versions
wuhuGargaj	3faad49bfcc3895e9ff76a591d05c8941273d120Affected

References

VDB-272070 | Gargaj wuhu Slide Editor slideeditor.php unrestricted uploadvdb-entrytechnical-description
VDB-272070 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #374846 | wuhu.function.hu Lightweight Party Management System party 2024 File Uploadthird-party-advisory
https://github.com/DeepMountains/Mirage/blob/main/CVE4-1.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.