CVE-2024-42640

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

45.37% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-94

Published

2024-10-11

Updated

2024-10-15

Proof-of-concept exploits (3)

• KTN1990/CVE-2024-426402★ · 2024-11-20
• rvizx/CVE-2024-4264027★ · 2025-07-12
• rvzsec/CVE-2024-42640

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-42640.yaml

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/52253
• https://www.exploit-db.com/exploits/52121

References

• CVE Record
• NVD entry

Related

• CVE-2019-10869
• CVE-2019-12815
• CVE-2019-9978
• CVE-2022-0316
• CVE-2024-13513
• CVE-2024-31351