CVE-2024-46540

EUVD-2024-41868
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining system privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
emlogemlog
𝑥
< 2.3.15
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
emlog_pro_projectemlog_pro
𝑥
< 2.3.15
ADP
Common Weakness Enumeration
References
https://gist.github.com/microvorld/1c1ef9c3390a5d88a5ede9f9424a8bd2
https://github.com/emlog/emlog
https://github.com/microvorld/CVE-2024/blob/main/emlog.md