CVE-2024-57408

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/kaoniniang2/2cfc83a612ba929279ed5fb8b91b45baThird Party Advisory
https://github.com/cool-team-official/cool-admin-javaProduct
https://github.com/kaoniniang2/exploit/blob/main/Cool-admin-File%20upload%20vulnerability.mdExploit, Third Party Advisory
https://github.com/kaoniniang2/exploit/blob/main/Cool-admin-File%20upload%20vulnerability.mdExploit, Third Party Advisory

Timeline

Published: Feb 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-574094.8A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitrary CVE-2024-57415.4Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)CVE-2024-574127.5An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets.CVE-2024-57426.7A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed whil CVE-2024-574236.1A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid para CVE-2024-574267.3NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a direc CVE-2024-574276.1PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user input CVE-2024-574289.3A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fi CVE-2024-574295.4A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote atta CVE-2024-57439.8An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arb CVE-2024-574309.8An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate datab CVE-2024-574327.5macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User infor