CVE-2024-3369 is a medium severity (CVSS 6.3) unrestricted file upload in code-projects Car Rental 1.0, through the Upload Image field of add-vehicle.php. The record lists no fix. Limit access, validate uploads on the server, and keep the upload folder from running code.
What's affected
The record names one product and version: Car Rental 1.0 from code-projects, a PHP application for managing a vehicle rental business. The affected file is add-vehicle.php, and the problem is the handling of the Upload Image argument. The record says the attack can be launched remotely and that the exploit has been disclosed publicly.
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That is network reachable, low complexity, no user interaction, and a low privilege account is required. All three impacts are rated low, which gives 6.3.
The record's references are a file shared on a cloud drive and the VulDB entry, VDB-259490. I did not open the shared file, since it is third party proof of concept material, and I could not confirm a vendor advisory. The record names no fixed version. It is not marked as exploited in the wild and is not in the CISA KEV list.
How to check if you're exposed
- Search for the application. A command such as
grep -rl "add-vehicle.php" /var/wwwfinds deployed copies. - Confirm the version is 1.0, the one the record covers.
- Find the folder where uploaded vehicle images are stored and list its contents. Anything that is not an image file is a warning sign.
- Check the web server configuration for that folder. If the server runs PHP files from it, an uploaded script would be executable.
- Review access logs for requests to the upload folder that ask for non image file extensions.
What to do now
- Remove the application from public access if you do not need it there, or place it behind a VPN or an allow list.
- Change the upload handler to accept only a short list of image types, checking the file content as well as the name, and store files under generated names.
- Store uploads outside the web root, or configure the web server so nothing in the upload folder is executed.
- Set a size limit on uploads.
- Remove any non image files already in the upload folder after you have preserved them for review.
- Check for a patched release from the vendor and record the result.
Why it matters
File upload is one of the easiest ways to turn a web form into a foothold. If the server accepts a file of the wrong type and then serves it from a place where scripts run, the file becomes code. The record scores the impact as low in each category, but that rating depends on what an uploaded file can reach in your setup. On a shared host with a high privilege database account, the real damage can be larger.
The fix is layered. Check type and content, rename the file, keep it somewhere that cannot execute, and give the application only the permissions it needs.
Quick check
Does CVE-2024-3369 need a login?
The vector says a low privilege account is required, so the attacker needs some level of access to the vehicle management screen.
Is there a patch for Car Rental 1.0?
The record lists no fixed version. Treat it as unpatched unless the vendor says otherwise.
Sources
Last reviewed: 19 October 2026.
