CVE-2024-6114

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in itsourcecode Monbela Tourist Inn Online Reservation System up to 1.0. Affected is an unknown function of the file controller.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268866 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
itsourcecode	Monbela Tourist Inn Online Reservation System	1.0
itsourcecode	monbela_tourist_inn_online_reservation_system	1.0

References

https://github.com/wangyuan-ui/CVE/issues/4Exploit, Third Party Advisory
https://vuldb.com/?ctiid.268866Permissions Required, Third Party Advisory
https://vuldb.com/?id.268866Third Party Advisory
https://vuldb.com/?submit.358995Third Party Advisory
https://github.com/wangyuan-ui/CVE/issues/4Exploit, Third Party Advisory
https://vuldb.com/?ctiid.268866Permissions Required, Third Party Advisory
https://vuldb.com/?id.268866Third Party Advisory
https://vuldb.com/?submit.358995Third Party Advisory

Timeline

Published: Jun 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-61159.8A vulnerability classified as critical was found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by this vulnerability CVE-2024-61169.8A vulnerability, which was classified as critical, has been found in itsourcecode Simple Online Hotel Reservation System 1.0. Affected by th CVE-2024-61178.8A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 202 CVE-2024-61189.1A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers CVE-2024-61197.5Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an inval CVE-2024-61206.5The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability CVE-2024-61217.8An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. Thi CVE-2024-61225.5An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information CVE-2024-61237.2The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function i CVE-2024-61245.4Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victi CVE-2024-61258.1The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This CVE-2024-61263.2A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv