CVE-2024-11984 — SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

CVE-2024-11984

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type PUBLISHED

Description (CNA)

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.

Affected (CNA)

Vendor / product	Versions
SUNNET Technology Co., Ltd. / Corporate Training Management System	affected 0 before 10.13

CWE

CWE-434

References

https://zuso.ai/advisory/za-2024-10

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.