CVE-2024-1115

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	openBI	1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8

References

https://note.zhaoj.in/share/81JmiyogcYL7Broken Link, Third Party Advisory
https://vuldb.com/?ctiid.252473Permissions Required, Third Party Advisory
https://vuldb.com/?id.252473Third Party Advisory
https://note.zhaoj.in/share/81JmiyogcYL7Broken Link, Third Party Advisory
https://vuldb.com/?ctiid.252473Permissions Required, Third Party Advisory
https://vuldb.com/?id.252473Third Party Advisory

Timeline

Published: Jan 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-111509.8The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th CVE-2024-111535.3The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vu CVE-2024-111544.3The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive In CVE-2024-111557.8A “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE fil CVE-2024-111567.8An “out of bounds write” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write CVE-2024-111577.3A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of alloc CVE-2024-111586.7An “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to cra CVE-2024-111594.3Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 CVE-2024-11169.8A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application CVE-2024-111655.7An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration re CVE-2024-111667.1For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a ground station and issue CVE-2024-111675.3An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users'