CVE-2024-55078

CVE-2024-55078 is an arbitrary file upload vulnerability in the /adminUser/updateImg component of WukongCRM-11.0-JAVA version 11.3.3. Published on 2025-01-03, the issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type). It enables attackers to upload crafted files that result in arbitrary code execution.

Remote, unauthenticated attackers (PR:N) can exploit the vulnerability with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows high-impact consequences, including unauthorized access to confidential data (C:H), modification of system integrity (I:H), and disruption of availability (A:H) via arbitrary code execution on the affected server.

Proof-of-concept details are available in provided references, including a GitHub Gist and a repository documenting the file upload vulnerability. No patch or mitigation guidance is specified in the available information.