CVE-2024-48760
Published: 14 January 2025
Summary
CVE-2024-48760 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Gestioip Gestioip. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Deeper analysis
GestioIP version 3.5.7 contains an arbitrary file upload flaw tracked as CVE-2024-48760 and assigned CWE-434. The vulnerability resides in the application’s file upload function, which permits an unauthenticated remote user to supply a malicious perlcmd.cgi file that overwrites the legitimate upload.cgi script and thereby enables execution of operating-system commands.
An attacker can reach the upload endpoint over the network without credentials or user interaction. Successful exploitation grants full control over the host, allowing arbitrary command execution with the privileges of the web-server process and satisfying the CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The EPSS score for this CVE rose from lower values after disclosure to a peak of 0.8180 on 2026-05-14 before receding to the current level of 0.7091, indicating that exploitation interest materialized well after the initial publication and that the issue merits renewed monitoring.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43244
Vulnerability details
An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
File upload vulnerability in GestioIP web application enables remote attackers to overwrite legitimate CGI script (upload.cgi) with malicious perlcmd.cgi for arbitrary code execution, facilitating public-facing application exploitation, web shell deployment, and host software binary compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents unrestricted upload of dangerous CGI files by validating file types, names, and content at the upload function to block malicious perlcmd.cgi overwrites.
Enforces restrictions on file uploads at the application boundary to prohibit executable CGI scripts and other dangerous types that enable file overwrites and RCE.
Deploys malicious code protection at system entry points to scan and block uploaded perlcmd.cgi files before they can overwrite upload.cgi and execute arbitrary commands.