CVE-2024-3705

Name of the Vulnerable Software and Affected Versions OpenGnsys version 1.1.1d (Espeto)

Description The issue allows an attacker to send a POST request to the endpoint '/opengnsys/images/M Icons.php' and modify the file extension due to a lack of file extension verification. This results in a webshell injection.

Recommendations For OpenGnsys version 1.1.1d (Espeto), as a temporary workaround, consider restricting access to the '/opengnsys/images/M Icons.php' endpoint until a patch is available. Additionally, implement file extension verification to prevent unauthorized file uploads.