CVE-2020-24203

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425 CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/hyd3sec/TravelManagementSystemRCEExploit, Third Party Advisory
https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/Exploit, Third Party Advisory
https://github.com/hyd3sec/TravelManagementSystemRCEExploit, Third Party Advisory
https://projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/Exploit, Third Party Advisory

Timeline

Published: Aug 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-242089.8A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authenti CVE-2020-242137.5An integer overflow was discovered in YGOPro ygocore v13.51. Attackers can use it to leak the game server thread's memory.CVE-2020-242149.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthentica CVE-2020-242159.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials CVE-2020-242167.5An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secre CVE-2020-242179.8An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce CVE-2020-242189.8An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard CVE-2020-242197.5An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests t CVE-2020-242208.8ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of CVE-2020-242215.5An issue was discovered in GetByte function in miniupnp ngiflib version 0.4, allows local attackers to cause a denial of service (DoS) via c CVE-2020-242227.8Buffer Overflow vulnerability in jfif_decode() function in rockcarry ffjpeg through version 1.0.0, allows local attackers to execute arbitra CVE-2020-242236.1Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.