CVE-2020-24199

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebAppExploit, Third Party Advisory
https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebApp/blob/master/CarRental-Unauth-RCE.pyExploit, Third Party Advisory
https://projectworlds.in/free-projects/php-projects/car-rental-project-in-php-and-mysql/Product
https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebAppExploit, Third Party Advisory
https://github.com/hyd3sec/CarRentalManagement-Unauth-RCE-WebApp/blob/master/CarRental-Unauth-RCE.pyExploit, Third Party Advisory
https://projectworlds.in/free-projects/php-projects/car-rental-project-in-php-and-mysql/Product

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-242029.8File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allo CVE-2020-242039.8Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management CVE-2020-242089.8A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authenti CVE-2020-242137.5An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory.CVE-2020-242149.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthentica CVE-2020-242159.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials CVE-2020-242167.5An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secre CVE-2020-242179.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce CVE-2020-242189.8An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard CVE-2020-242197.5An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests t CVE-2020-242208.8ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of CVE-2020-242215.5An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via c