Vulnerability Description
SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.
Related Weaknesses (CWE)
References
- https://blog.csdn.net/qq_36618918/article/details/135505570
- https://sponcomm.com/collections/ip-intercom-system
- https://www.vulncheck.com/advisories/spon-ip-network-intercom-system-arbitrary-f
FAQ
What is CVE-2024-13982?
CVE-2024-13982 is a documented vulnerability. SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arise...
How severe is CVE-2024-13982?
CVSS scoring is not yet available for CVE-2024-13982. Check NVD for updates.
Is there a patch for CVE-2024-13982?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.