CVE-2020-24203: projectworlds travel_management_system Forced Browsing
Vulnerability summary
CVE-2020-24203 is a critical (CVSS 9.8) Forced Browsing vulnerability in projectworlds travel_management_system. EPSS estimates a 3.74% chance of exploitation in the next 30 days, higher than 89.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 27-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.74%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.74% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundTravelmanagementsystemrce
Maturity: poc
Exploit Reference (projectworlds.in)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Projectworlds1 product
1 vendor · 1 product
References
2 links- projectworlds.in/free-projects/php-projects/travel-management-system-project-in-php-mysql/X Refsource MISCExploitThird Party Advisory