CVE-2024-11680

ProjectSend Unauthenticated Configuration Modification

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Affected

ProjectSend

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

91.85% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-12-03

Nuclei

critical

Published

2024-11-26

Updated

2026-07-14

Proof-of-concept exploits (2)

• https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vuln…
• D3N14LD15K/CVE-2024-11680_PoC_Exploit12★ · 2025-01-31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11680.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rc…

Security advisories

• projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass…
• https://vulncheck.com/advisories/projectsend-bypass
• projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744

References

• CVE Record
• NVD entry

Related

• CVE-2024-7593