CVE-2020-24195

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/158704/Online-Bike-Rental-1.0-Shell-Upload.htmlThird Party Advisory, VDB Entry
https://www.sourcecodester.com/php/14374/online-bike-rental-phpmysql.htmlProduct
https://packetstormsecurity.com/files/158704/Online-Bike-Rental-1.0-Shell-Upload.htmlThird Party Advisory, VDB Entry
https://www.sourcecodester.com/php/14374/online-bike-rental-phpmysql.htmlProduct

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-241967.2An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.CVE-2020-241979.8A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL command CVE-2020-241986.1A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary w CVE-2020-241999.8Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct CVE-2020-242029.8File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allo CVE-2020-242039.8Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management CVE-2020-242089.8A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authenti CVE-2020-242137.5An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory.CVE-2020-242149.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthentica CVE-2020-242159.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials CVE-2020-242167.5An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secre CVE-2020-242179.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce