← Back to browse · API

CVE-2024-34990

Severity
CRITICAL
CVSS
10.0
EPSS
0.00514
Risk score
40.18
CISA KEV
No
PoC
No
Published
2024-06-19
Modified
2024-08-02
First seen
2026-08-08
Aliases
EUVD-2024-35139, GHSA-VCQG-Q2PP-CH79
Products
n/a:n/a n/a
Sources
euvd EUVD-2024-35139

Description

In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.

References