File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.
References
| Link | Resource |
|---|---|
| https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md | Exploit Third Party Advisory |
| https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md | Exploit Third Party Advisory |
Configurations
History
17 Jun 2025, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Magicflue magicflue
Magicflue |
|
| CPE | cpe:2.3:a:magicflue:magicflue:*:*:*:*:*:*:*:* | |
| References | () https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md - Exploit, Third Party Advisory |
21 Nov 2024, 09:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md - |
22 Aug 2024, 18:35
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-434 |
22 Mar 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-22 02:15
Updated : 2025-06-17 14:26
NVD link : CVE-2024-28441
Mitre link : CVE-2024-28441
CVE.ORG link : CVE-2024-28441
JSON object : View
Products Affected
magicflue
- magicflue
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type