Cyber Resilience

CVE-2024-40110

CriticalPublic PoCRCE

Published: 12 July 2024

Published
12 July 2024
Modified
23 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3034 96.8th percentile
Risk Priority 38 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-40110 is a critical-severity Command Injection (CWE-77) vulnerability in Nikhil-Bhalerao Poultry Farm Management System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Sourcecodester Poultry Farm Management System version 1.0 is affected by an unauthenticated remote code execution vulnerability tracked as CVE-2024-40110. The flaw resides in the productimage parameter processed by the /farm/product.php endpoint and is classified under CWE-77. It received a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network access can submit a malicious payload through the productimage field to execute arbitrary operating-system commands on the server. Successful exploitation grants full confidentiality, integrity, and availability impact, allowing complete system compromise without authentication.

Public references consist of GitHub repositories that demonstrate the unauthenticated RCE vector; no vendor advisory or official patch information is included in the available references.

The CVE carries an EPSS score of 0.3034 with a recorded peak of 0.3221, indicating sustained and moderately elevated exploitation interest following disclosure.

EU & UK References

Vulnerability details

Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /farm/product.php.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unauthenticated RCE via productimage parameter in public-facing web app enables T1190 (Exploit Public-Facing Application); facilitates T1505.003 (Web Shell) by allowing upload and execution of PHP backdoor for command execution.

Affected Assets

nikhil-bhalerao
poultry farm management system
1.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References