CVE-2023-39424

Summary

CVE-2023-39424 is a vulnerability affecting RDPngFileUpload.dll in the IRM Next Generation booking system. An attacker can exploit this issue to upload arbitrary content, including web shell components, to the SQL database and execute it with SYSTEM privileges. Authentication is required to exploit this vulnerability, but it can be combined with CVE-2023-39420, which grants access to hardcoded credentials, to carry out attacks without needing assigned credentials.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.