Lucene search

PRIOn knowledge basePRION:CVE-2024-24026

HistoryFeb 08, 2024 - 1:15 a.m.

Privilege escalation

2024-02-0801:15:00

PRIOn knowledge base

www.prio-n.com

privilege escalation

file upload

vulnerability

novel-plus v4.3.0-rc1

sysusercontroller

arbitrary file download

7.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.3%

JSON

An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController: uploadImg(). An attacker can pass in specially crafted filename parameter to perform arbitrary File download.

CPENameOperatorVersion
novel-plusle4.2.0
novel-pluseq4.3.0 rc1

CPE	Name	Operator	Version
	novel-plus	le	4.2.0
	novel-plus	eq	4.3.0 rc1

References

github.com/201206030/novel-plus

github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24026.txt