CVE-2024-0933 is a medium severity flaw (CVSS 6.3) in Niushop B2B2C. The record says the vendor did not respond, and no fixed version is listed. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
Niushop B2B2C V5, the file app/model/Upload.php.
The record gives a CVSS base score of 6.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness class is CWE-434.
The record scores this 6.3 Medium and says the upload function in the model file accepts files without adequate restriction.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record says the vendor did not respond, and no fixed version is listed.
How to check if you're exposed
Check your deployed version against V5 and review the upload model file. Search the upload directory for files with script extensions that you did not put there.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0933 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of Niushop B2B2C in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record says the vendor did not respond, and no fixed version is listed.
- Apply mitigations while you wait: block script execution in upload directories, validate file type server side, and restrict who can reach the upload endpoint.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is unrestricted file upload, CWE-434. An upload handler accepts files without enough checks on type, name or destination, so an attacker with access to the endpoint may be able to place a file the server will later treat as code or content.
Upload bugs turn into remote code execution when the stored file lands somewhere the web server will run it. Whether that applies here depends on the deployment, so treat the endpoint as dangerous until you have a fixed build or a control in front of it.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
How do I limit damage from upload bugs?
Block script execution in upload folders, check file types on the server and limit who can upload.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record says the vendor did not respond, and no fixed version is listed. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://docs.qq.com/doc/DYnNWeHdTVXZqZURH
- https://vuldb.com/?ctiid.252140
- https://vuldb.com/?id.252140
- Safeguard Gold record for CVE-2024-0933
Last reviewed: 19 October 2026.
