admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-06 02:31:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-24573.md
0xMarcio 48a00929ac Removed duplicates
2024-06-18 02:51:15 +02:00

962 B
Raw Permalink Blame History

CVE-2024-24573

Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

POC

Reference

Github

No PoCs found on GitHub currently.