CVE-2024-7911: oretnom23 simple_online_bidding_system External Control of File Name or Path
Vulnerability summary
CVE-2024-7911 is a critical (CVSS 9.8) External Control of File Name or Path vulnerability in oretnom23 simple_online_bidding_system. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-08-2024PublishedVulnerability first disclosed.
- 19-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument page leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST6.5MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.75% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCve
Maturity: poc
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products