CVE-2024-8164

Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted upload

State: Published
Severity: 5.3 Medium
Published: Aug 26, 2024
Updated: Nov 24, 2025
Reserved: Aug 26, 2024

Description

A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. This affects the function rename of the file /Admin/Http/Controllers/FileManagerController.php. This manipulation of the argument new_name causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.6.0 is able to mitigate this issue. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-434 Unrestricted Upload
CWE-284 Improper Access Controls

Affected Products

Product	Versions
BeikeShopChengdu Everbrite Network Technology	1.5.0Affected 1.5.1Affected 1.5.2Affected 1.5.3Affected 1.5.4Affected 1.5.5Affected 1.6.0Not affected

References

VDB-275762 | Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted uploadvdb-entrytechnical-description
VDB-275762 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #393375 | Chengdu Guangda Network Technology BeikeShop <=v1.5.5 FileUploadthird-party-advisory
https://github.com/DeepMountains/zzz/blob/main/CVE4-2.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.