CVE-2024-1818 is a medium severity (CVSS 4.7) unrestricted file upload flaw in CodeAstro Membership Management System version 1.0 from CodeAstro. It affects the logo upload. The record names no fixed version, so check the project page, patch the code yourself, or retire the application.
What's affected
CodeAstro Membership Management System version 1.0, from CodeAstro. The record lists version 1.0 only, and does not name any newer or patched release.
The description puts the flaw in the file /uploads/, part of the Logo Handler component. The weakness is CWE-434, unrestricted file upload. The description says the attack can be launched remotely and that the exploit has been disclosed publicly and may be used.
Severity conflict. The description text, which follows the VulDB style, calls this issue critical. NVD's own CVSS 3.1 score is 4.7, which is Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. The vector requires high privileges, which is why the score is lower: an attacker needs an administrator style account first.
How to check if you're exposed
Start by finding the install and the upload folder, then look at what is stored there:
find /var/www/html -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*upload*" 2>/dev/null
Script files inside an upload directory are a red flag, because users should be uploading images, not code. If you find any you did not place there, treat the server as possibly compromised and investigate before you patch.
Also check how the web server treats that folder. If it can execute PHP from the upload path, the weakness is much more dangerous than if it can only serve static files. Review your access logs for requests to files in that folder with unusual extensions.
What to do now
- Decide whether you actually run this application. If it is unused or a demo, take it offline and delete it.
- Look in the upload directory for script files and anything you do not recognise. If you find some, isolate the host and investigate first.
- Configure the web server so the upload directory cannot execute scripts, for example by disabling PHP handling for that path.
- Restrict uploads to an allowlist of image types, check content as well as extension, and rename files on save.
- Check the project page for a fixed release. The record names none, so plan to patch the code yourself or replace the application.
Why it matters
Unrestricted upload bugs let a user put a file on the server that the developer never intended. When the file is a script and the server will run it from the upload folder, the result is code execution under the web server account. When uploads are only served as static content, the risk is smaller but includes stored cross site scripting and disk exhaustion.
Here the record rates the privilege requirement as high, so an attacker needs a privileged account before an upload can be made, which narrows who can abuse it but does not remove the risk from stolen or shared admin passwords. The safe design is to check the file against an allowlist of types, rename it on save, store it outside the web root or on a host that cannot run scripts, and require an authorised user.
The record's Known Exploited Vulnerabilities flag is false. The description says the exploit has been disclosed publicly and may be used.
Quick check
Does the attacker need to be an admin?
The vector in the record lists a high privilege requirement, so a privileged account is needed first.
Is there a patch?
The record names none. Check the CodeAstro project page, and otherwise fix the upload code yourself.
Sources
- NVD record for CVE-2024-1818
- VulDB entry 254606 (listed in the record, not retrievable when reviewed)
Last reviewed: 19 October 2026.
