CVE-2024-4820

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/SystemSettings.php?f=update_settings. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263941 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Online Computer and Laptop Store	1.0

References

https://github.com/jxm68868/cve/blob/main/upload.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.263941Permissions Required, VDB Entry
https://vuldb.com/?id.263941Third Party Advisory, VDB Entry
https://vuldb.com/?submit.333272Third Party Advisory, VDB Entry
https://github.com/jxm68868/cve/blob/main/upload.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.263941Permissions Required, VDB Entry
https://vuldb.com/?id.263941Third Party Advisory, VDB Entry
https://vuldb.com/?submit.333272Third Party Advisory, VDB Entry

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-482008.4An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte CVE-2024-482029.8icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.CVE-2024-482049.8SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted CVE-2024-482069.8A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.CVE-2024-482088.6pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.CVE-2024-48215.4The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_lightbo CVE-2024-482134.3RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.CVE-2024-482148.4KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. T CVE-2024-482178.8An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.CVE-2024-482187.2Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.CVE-2024-48226.1Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability CVE-2024-482227.2Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.