CVE-2024-3437

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259631.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Prison Management System	1.0
sourcecodester	prison_management_system	1.0

References

https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259631Permissions Required, VDB Entry
https://vuldb.com/?id.259631Third Party Advisory, VDB Entry
https://vuldb.com/?submit.311920Third Party Advisory, VDB Entry
https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.259631Permissions Required, VDB Entry
https://vuldb.com/?id.259631Third Party Advisory, VDB Entry
https://vuldb.com/?submit.311920Third Party Advisory, VDB Entry

Timeline

Published: Apr 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-343707.2Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooComme CVE-2024-343714.3Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone numb CVE-2024-343725.3Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.CVE-2024-343735.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor CVE-2024-343745.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for E CVE-2024-343755.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync al CVE-2024-343766.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.T CVE-2024-343774.3Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Galle CVE-2024-343788.6Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.CVE-2024-343794.3Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1 CVE-2024-34389.8A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown process CVE-2024-343806.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for