CVE-2024-1577 is a critical (CVSS 9.8) remote code execution flaw in MegaBIP software, through version 5.11.2. An attacker can run arbitrary code on the server without authentication by saving crafted PHP code to one of the website's files. Upgrade past 5.11.2 using the vendor's current release.
What's affected
CERT Polska's advisory of 12 June 2024 lists MegaBIP by Jan Syski, all versions through 5.11.2 for this CVE. That matches the NVD record. The advisory text I read does not name a fixed version, so check megabip.pl for the current release.
Two siblings were disclosed together: CVE-2024-1576, SQL injection through 5.09, and CVE-2024-1659, unrestricted file upload through 5.10. If you are on 5.11.2 you are past the other two but still inside this one.
How to check if you're exposed
Read the version from the MegaBIP administration panel. Then check the web root for unexpected PHP files and for recent modification times on files that should be static:
find /var/www -name "*.php" -mtime -30
Adjust the path and window for your server. Any file you did not put there deserves investigation.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the MegaBIP version.
- Upgrade to a vendor release newer than 5.11.2.
- Check site files for unexpected changes and restore from a clean backup if needed.
- Make the web root read only for the web server user where possible.
- Review logs for requests that write to site files.
Why it matters
The record classes this as CWE-94, improper control of code generation. The application let a visitor save content into a file that the server would later run as PHP, so the content became code.
Remote code execution without a login is the worst case for an internet-facing site. The attacker acts with the web server's rights and can read configuration, data and credentials. The record's KEV flag is false. If you suspect exposure, restore from a clean backup rather than cleaning the files by hand, and rotate database and administrator credentials afterwards.
Quick check
Does this need a login?
No. The record says no authentication is required.
Which sibling CVEs exist?
CVE-2024-1576 and CVE-2024-1659, in the same CERT Polska advisory.
Sources
- CERT Polska advisory
- MegaBIP vendor site (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1577
Last reviewed: 19 October 2026.
