{"id":"GHSA-cr7j-rwmv-vgch","summary":"Duplicate Advisory: aimeos-core arbitrary file upload vulnerability","details":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-rhc2-23c2-ww7c. This link is maintained to preserve external references.\n\n## Original Description\nAn arbitrary file upload vulnerability in the image upload function of aimeos-core v2024.04 allows attackers to execute arbitrary code via uploading a crafted PHP file.","aliases":["CVE-2024-36811"],"modified":"2026-09-10T03:50:15.290658270Z","published":"2024-06-07T21:31:54Z","withdrawn":"2024-06-20T16:34:33Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2024-06-07T21:56:01Z","nvd_published_at":"2024-06-07T19:15:23Z","cwe_ids":["CWE-434"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36811"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/4544"},{"type":"WEB","url":"https://github.com/aimeos/aimeos-core/commit/13e163126adff48f987b3b6faca28551effe0205"},{"type":"WEB","url":"https://github.com/aimeos/aimeos-core/commit/5eea7aa933ac7402044bc6d282f96fba44475ee2"},{"type":"WEB","url":"https://drive.google.com/file/d/1QJWwaDB6smLCuNp10yZKWgpELTQJax31/view?usp=sharing"},{"type":"WEB","url":"https://drive.google.com/file/d/1n5_t-zmKHbx3H47xdhR5kuHTDc0Gxur3/view?usp=sharing"},{"type":"PACKAGE","url":"https://github.com/aimeos/aimeos-core"},{"type":"WEB","url":"https://github.com/ssshah2131/CVE/blob/main/Aimeos_RCE"}],"affected":[{"package":{"name":"aimeos/aimeos-core","ecosystem":"Packagist","purl":"pkg:composer/aimeos/aimeos-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.04.5"}]}],"versions":["2013.07.0","2013.07.1","2014.03.0","2014.03.1","2014.03.2","2014.03.3","2014.05.0","2014.07.0","2015.03.0","2015.03.1","2015.03.10","2015.03.2","2015.03.3","2015.03.4","2015.03.5","2015.03.6","2015.03.7","2015.03.8","2015.03.9","2015.07.1","2015.07.2","2015.07.3","2015.07.4","2015.07.5","2015.07.6","2015.10.1","2015.10.10","2015.10.11","2015.10.12","2015.10.13","2015.10.14","2015.10.15","2015.10.16","2015.10.17","2015.10.18","2015.10.2","2015.10.3","2015.10.4","2015.10.5","2015.10.6","2015.10.7","2015.10.8","2015.10.9","2016.01.1","2016.01.2","2016.01.3","2016.01.4","2016.01.5","2016.01.6","2016.01.7","2016.01.8","2016.03.1","2016.03.2","2016.04.1","2016.04.10","2016.04.11","2016.04.12","2016.04.13","2016.04.2","2016.04.3","2016.04.4","2016.04.5","2016.04.6","2016.04.7","2016.04.8","2016.04.9","2016.07.1","2016.07.2","2016.07.3","2016.07.4","2016.07.5","2016.07.6","2016.10.1","2016.10.10","2016.10.11","2016.10.12","2016.10.13","2016.10.14","2016.10.2","2016.10.3","2016.10.4","2016.10.5","2016.10.6","2016.10.7","2016.10.8","2016.10.9","2017.01.1","2017.01.2","2017.01.3","2017.01.4","2017.04.1","2017.04.10","2017.04.11","2017.04.2","2017.04.3","2017.04.4","2017.04.5","2017.04.6","2017.04.7","2017.04.8","2017.04.9","2017.07.1","2017.07.2","2017.07.3","2017.07.4","2017.07.5","2017.10.1","2017.10.10","2017.10.11","2017.10.12","2017.10.13","2017.10.14","2017.10.15","2017.10.2","2017.10.3","2017.10.4","2017.10.5","2017.10.6","2017.10.7","2017.10.8","2017.10.9","2018.01.1","2018.01.2","2018.01.3","2018.01.4","2018.01.5","2018.01.6","2018.01.7","2018.04.1","2018.04.2","2018.04.3","2018.04.4","2018.04.5","2018.04.6","2018.04.7","2018.04.8","2018.07.1","2018.07.10","2018.07.11","2018.07.12","2018.07.13","2018.07.14","2018.07.15","2018.07.16","2018.07.17","2018.07.18","2018.07.19","2018.07.2","2018.07.20","2018.07.21","2018.07.22","2018.07.23","2018.07.3","2018.07.4","2018.07.5","2018.07.6","2018.07.7","2018.07.8","2018.07.9","2018.10.1","2018.10.10","2018.10.11","2018.10.12","2018.10.13","2018.10.14","2018.10.15","2018.10.16","2018.10.17","2018.10.18","2018.10.19","2018.10.2","2018.10.20","2018.10.21","2018.10.22","2018.10.23","2018.10.24","2018.10.25","2018.10.3","2018.10.4","2018.10.5","2018.10.6","2018.10.7","2018.10.8","2018.10.9","2019.01.1","2019.01.2","2019.01.3","2019.01.4","2019.01.5","2019.04.1","2019.04.2","2019.04.3","2019.04.4","2019.04.5","2019.04.6","2019.04.7","2019.04.8","2019.07.1","2019.07.10","2019.07.11","2019.07.2","2019.07.3","2019.07.4","2019.07.5","2019.07.6","2019.07.7","2019.07.8","2019.07.9","2019.10.1","2019.10.10","2019.10.11","2019.10.12","2019.10.13","2019.10.14","2019.10.15","2019.10.16","2019.10.17","2019.10.18","2019.10.19","2019.10.2","2019.10.20","2019.10.21","2019.10.22","2019.10.23","2019.10.24","2019.10.25","2019.10.26","2019.10.27","2019.10.28","2019.10.29","2019.10.3","2019.10.30","2019.10.31","2019.10.32","2019.10.33","2019.10.34","2019.10.35","2019.10.4","2019.10.5","2019.10.6","2019.10.7","2019.10.8","2019.10.9","2020.01.1","2020.01.2","2020.04.1","2020.04.2","2020.04.3","2020.04.4","2020.04.5","2020.07.1","2020.07.2","2020.07.3","2020.07.4","2020.10.1","2020.10.10","2020.10.11","2020.10.12","2020.10.13","2020.10.14","2020.10.15","2020.10.16","2020.10.17","2020.10.18","2020.10.19","2020.10.2","2020.10.20","2020.10.21","2020.10.22","2020.10.23","2020.10.24","2020.10.25","2020.10.26","2020.10.27","2020.10.28","2020.10.29","2020.10.3","2020.10.4","2020.10.5","2020.10.6","2020.10.7","2020.10.8","2020.10.9","2021.04.1","2021.04.2","2021.04.3","2021.04.4","2021.04.5","2021.04.6","2021.04.7","2021.04.8","2021.07.1","2021.07.2","2021.07.3","2021.07.4","2021.07.5","2021.07.6","2021.10.1","2021.10.10","2021.10.11","2021.10.12","2021.10.13","2021.10.14","2021.10.15","2021.10.16","2021.10.17","2021.10.18","2021.10.19","2021.10.2","2021.10.20","2021.10.21","2021.10.22","2021.10.23","2021.10.24","2021.10.25","2021.10.26","2021.10.27","2021.10.28","2021.10.3","2021.10.4","2021.10.5","2021.10.6","2021.10.7","2021.10.8","2021.10.9","2022.04.1","2022.04.10","2022.04.2","2022.04.3","2022.04.4","2022.04.5","2022.04.6","2022.04.7","2022.04.8","2022.04.9","2022.07.1","2022.07.2","2022.07.3","2022.07.4","2022.07.5","2022.07.6","2022.07.7","2022.07.8","2022.10.1","2022.10.10","2022.10.11","2022.10.12","2022.10.13","2022.10.14","2022.10.15","2022.10.16","2022.10.17","2022.10.18","2022.10.19","2022.10.2","2022.10.3","2022.10.4","2022.10.5","2022.10.6","2022.10.7","2022.10.8","2022.10.9","2023.04.1","2023.04.2","2023.04.3","2023.04.4","2023.04.5","2023.04.6","2023.07.1","2023.07.2","2023.07.3","2023.10.1","2023.10.10","2023.10.11","2023.10.12","2023.10.13","2023.10.14","2023.10.15","2023.10.16","2023.10.17","2023.10.18","2023.10.19","2023.10.2","2023.10.20","2023.10.21","2023.10.22","2023.10.23","2023.10.24","2023.10.25","2023.10.26","2023.10.3","2023.10.4","2023.10.5","2023.10.6","2023.10.7","2023.10.8","2023.10.9","2024.04.1","2024.04.2","2024.04.3","2024.04.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-cr7j-rwmv-vgch/GHSA-cr7j-rwmv-vgch.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}