Cyber Posture

CVE-2024-55507

CriticalPublic PoC

Published: 03 January 2025

Published
03 January 2025
Modified
03 April 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0049 65.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-55507 is a privilege escalation vulnerability affecting CodeAstro Complaint Management System version 1.0. The flaw exists in the delete_e.php component, where improper handling allows unauthorized privilege elevation. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-281.

A remote attacker requires only network access, low attack complexity, no prior privileges, and no user interaction to exploit the vulnerability. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing the attacker to escalate privileges on the affected system.

Mitigation details are available in the referenced advisory at https://github.com/CV1523/CVEs/blob/main/CVE-2024-55507.md, published on 2025-01-03.

Details

CWE(s)
CWE-281

Affected Products

codeastro
complaint management system
1.0

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2024-55507 enables remote privilege escalation via a web application component (delete_e.php), facilitating T1068 (Exploitation for Privilege Escalation) and T1190 (Exploit Public-Facing Application).

References