CVE-2024-50660
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A file upload bypass vulnerability in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality.
Risk Assessment
An attacker can upload a malicious file and gain full control over the server, leading to compromise of data confidentiality, integrity, and availability.
Recommendation
Immediately update AdPortal to the latest version and implement file type validation and permission restrictions on the upload directory.
Other vulnerabilities in AdPortal
See all- CVE-2024-50658Critical
A Server-Side Template Injection (SSTI) vulnerability was found in AdPortal 3.0.39. A remote attacker can exploit the shippingAsBilling and firstname parameters in the updateuserinfo.html file to execute arbitrary code.
- CVE-2024-50659Medium
A Cross Site Scripting (XSS) vulnerability in iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingAsBilling parameter in updateuserinfo.html.
Original NVD description (English source)
File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality