ID:10967 - Exploit for Improper Authentication in ProjectSend - CVE-2024-11680

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization within the options.php file. A remote non-authenticated attacker can send a specially crafted HTTP request to the application and modify its configuration, which can lead to malicious file uploads and remote code execution.

Remediation