CVE-2024-24122

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restart the system, and automatically execute the constructed attack script.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24139.8Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the use CVE-2024-241306.1Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter CVE-2024-241316.1SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.CVE-2024-241339.8Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.CVE-2024-241344.8Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M CVE-2024-241356.1Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS CVE-2024-241366.1The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X CVE-2024-241397.2Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.CVE-2024-24148.8The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open CVE-2024-241407.2Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'CVE-2024-241419.8Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.CVE-2024-241429.8Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.