CVE-2024-4306 is a Critical (CVSS 9.9) unrestricted file upload in HubBank version 1.0.2. The record says a registered user can upload PHP files through document upload fields and get a web shell. It names no fix. Take the app off untrusted networks and read the INCIBE CERT notice.
What's affected
- Product: HubBank 1.0.2, listed under the vendor name ofofonobsdev.
- Affected feature: document upload fields reachable by a registered user.
- Fixed version: none in the record. The INCIBE CERT notice is the source, but it returned a block page when I tried it, so check it yourself.
- Severity: Critical, CVSS 9.9, with a changed scope (S:C) and a low privilege requirement.
- Exploitation: KEV is false and I found no report of attacks.
- This record is one of several for HubBank. CVE-2024-4307 covers SQL injection in other endpoints.
How to check if you're exposed
First, find out whether HubBank runs anywhere in your estate. It looks like a demo style banking application, so check test and training servers too.
If it does run, look in the upload directory for files with executable extensions such as .php, and review web logs for requests to those files. A PHP file in a folder meant for documents is a strong warning sign.
What to do now
- Locate any HubBank 1.0.2 deployment.
- Take it off the internet and restrict registration until the upload handler is fixed.
- Search upload directories for script files and remove any you did not put there, after preserving copies for investigation.
- Configure the web server so the upload directory cannot execute scripts.
- Read the INCIBE CERT notice for the vendor's guidance and any fix.
Why it matters
The record maps this to CWE-434, unrestricted upload of a file with a dangerous type. The application accepts a file and stores it where the web server can run it. The site's trust in a registered user becomes code execution.
The defense is layered. Allow only the file types you need, check content and not just names, store uploads outside the web root, and never let the upload folder run scripts.
Quick check
Why 9.9 and not 9.8?
The vector uses a changed scope with a low privilege requirement, which scores one tenth higher than the unauthenticated 9.8 pattern.
Does the attacker need to register?
The record says a registered user can do it. Open registration makes that a low bar.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4306 (published 2024-04-29) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
