CVE-2024-1034

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252309 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	openBI	1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8

References

https://note.zhaoj.in/share/ABYkFE4wRPW5Broken Link
https://vuldb.com/?ctiid.252309Third Party Advisory
https://vuldb.com/?id.252309Third Party Advisory
https://note.zhaoj.in/share/ABYkFE4wRPW5Broken Link
https://vuldb.com/?ctiid.252309Third Party Advisory
https://vuldb.com/?id.252309Third Party Advisory

Timeline

Published: Jan 30, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-103406.4The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'scu' shortcode in versions up CVE-2024-103416.5The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and inclu CVE-2024-103425.4The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and inc CVE-2024-103436.4The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including,CVE-2024-103448.7In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported CVE-2024-103458.7In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reporte CVE-2024-103485.4A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been classified as problematic. This affects an CVE-2024-103499.8A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Affected by this issue is th CVE-2024-10359.8A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the f CVE-2024-103509.8A vulnerability was found in code-projects Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unkn CVE-2024-103518.8A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the fil CVE-2024-103524.3The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,