CVE-2024-50660

CriticalRCE

Published: 07 January 2025

Published

07 January 2025

Modified

10 October 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0113 78.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-50660 is a critical-severity Code Injection (CWE-94) vulnerability in Ipublishmedia Adportal. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly prevents file upload bypass vulnerabilities by enforcing validation of uploaded files to block malicious code injection.

SI-9 Information Input Restrictions good match

prevent

SI-9 restricts file upload inputs by type, size, and other attributes, mitigating bypasses that allow arbitrary code execution.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely patching and remediation of the specific file upload flaw in AdPortal 3.0.39.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Direct unauthenticated RCE on public-facing web app via malicious file upload enables T1190 and web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload functionality

Deeper analysisAI

CVE-2024-50660 is a critical file upload bypass vulnerability in AdPortal 3.0.39, enabling remote attackers to execute arbitrary code through the file upload functionality. Assigned CWE-94 (code injection), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and potential for complete compromise of confidentiality, integrity, and availability.

Any unauthenticated remote attacker can exploit this vulnerability by uploading malicious files via the affected functionality, leading to arbitrary code execution on the server. The attack requires no special privileges or user interaction, making it highly practical for widespread exploitation against exposed AdPortal 3.0.39 instances.

Mitigation details are available in vendor advisories and related documents, including resources at http://adportal.com, http://ipublish.com, and https://petercipolone.info/wp-content/uploads/2025/01/iPublishMedia_AdPortal3.0.39_CVEs.pdf, which security practitioners should review for patching instructions, workarounds, or configuration changes. The vulnerability was published on 2025-01-07.