CVE-2024-24350

[CVE ID]
CVE-2024-24350


[Suggested description]
> File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and
> before allows a remote attacker to execute arbitrary code via the
> extension filtering component.
>
> ------------------------------------------
>
> [VulnerabilityType Other]
> Unrestricted File Upload
>
> ------------------------------------------
>
> [Vendor of Product]
> Software Publico
>
> ------------------------------------------
>
> [Affected Product Code Base]
> e-Sic Livre - <= 2.0
>
> ------------------------------------------
>
> [Affected Component]
> affected source code file.
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> To exploit this vulnerability you need to be authenticated.
>
> ------------------------------------------
>
> [Reference]
> https://medium.com/@viniciuspinheiros/e-sic-livre-2-0-authenticated-file-upload-leads-to-remote-code-execution-rce-5937c9537258
>
> ------------------------------------------
>
> [Discoverer]
> Enkrypta Research