CVE-2024-8707: 云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-12 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Yunknet Yunke Online School System: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+1)

References

https://vuldb.com/?ctiid.277216
https://vuldb.com/?id.277216
https://vuldb.com/?submit.402917
https://wiki.shikangsi.com/post/share/1200e7c6-4514-44e3-980c-298e0b9ccade

Get alerted when CVE-2024-8707 or the next vulnerability affects your stack