CVE-2024-4681 is a medium severity unrestricted file upload flaw in Campcodes Legal Case Management System 1.0, scored 4.7 by NVD. It sits in the admin general settings page. The record lists no fixed version, so treat the product as unpatched, limit who can reach the admin area, and plan a replacement.
What's affected
The record names one product and one version: Campcodes Legal Case Management System 1.0. The weak spot is the file /admin/general-setting, in a component the description calls the Setting Handler. The favicon and logo parameters accept an upload that is not properly restricted. The weakness class is CWE-434, unrestricted upload of a file with a dangerous type.
The record describes the issue as remotely reachable and says the exploit has been disclosed publicly. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.
Severity needs a note. The VulDB text in the record calls the bug critical, while NVD scores it 4.7, medium, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The difference comes from the privileges required: the vector says PR:H, meaning an attacker needs high privileges, which here means an admin login. Both ratings come from the same record, so quote both when you report this internally.
How to check if you're exposed
This is a downloadable PHP code sample project, not a package from a registry, so there is no package manager command to run. Instead:
- Find any deployment of Campcodes Legal Case Management System. Search your web roots for a directory containing an
adminfolder with ageneral-settingpage. - Confirm the version. The record only covers 1.0.
- Check whether the admin area is reachable from outside your network.
- Look in the folder that stores the favicon and logo for files that are not images.
The free in-browser dependency scan at gold.safeguard.sh/scan covers libraries your projects declare. It will not see a hand copied PHP application, so use an inventory of what you have deployed as well.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list.
- Limit admin accounts to people who need them and change their passwords.
- At the web server, stop the upload folder from executing scripts, and allow only image extensions there.
- Clean the upload folder of anything that is not a real image.
- Check the advisory pages below for a vendor fix. The record lists none, and the sources do not confirm one.
- Plan to replace the system if no maintained release appears.
Why it matters
Upload handlers must check what they receive, not only what the form promises. When a settings page accepts any file for a logo field, the server may store content that it later serves or runs. That is the core of CWE-434.
The 4.7 score is modest because the attacker needs an admin session first. Even so, legal case software holds client matter data, and a weak admin password turns a medium score into a real incident. Reachability analysis helps here: an upload page that is not exposed to the internet is a very different case from one that is.
Quick check
Is CVE-2024-4681 exploited in the wild?
The record's KEV flag is false and no source here reports active exploitation. It does say a public disclosure exists, so do not rely on obscurity.
Is there a patched version?
The record lists none. Check with the vendor and treat the product as unpatched until a fix is confirmed.
Sources
Last reviewed: 19 October 2026.
