Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Remediation

References

CVE-2024-11680

Related Vulnerabilities

WordPress Plugin Minimal Coming Soon & Maintenance Mode-Coming Soon Page Security Bypass (1.87)

WordPress Plugin GB Team Stats Cross-Site Scripting (1.5.1)

WordPress Plugin wpDataTables-WordPress Data Table, Dynamic Tables & Table Charts SQL Injection (1.5.3)

Oracle JRE CVE-2024-21217 Vulnerability (CVE-2024-21217)

WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress Cross-Site Scripting (3.10.1)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2024-11680