CVE-2024-25228

2024-03-1400:00:00

mitre

github.com

vinchin backup

recovery

authenticated

remote code execution

getverifydiyresult

manoeuvrehandler class

cve-2024-25228

AI Score

7.5

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:vinchin:vinchin_backup_and_recovery:*:*:*:*:*:*:*:*"
    ],
    "vendor": "vinchin",
    "product": "vinchin_backup_and_recovery",
    "versions": [
      {
        "status": "affected",
        "version": "7.2"
      }
    ],
    "defaultStatus": "unknown"
  }
]