CVE-2024-4820 is a medium severity unrestricted file upload flaw in SourceCodester Online Computer and Laptop Store 1.0, scored 6.3. The settings update function accepts uploads without proper limits. The record lists no fixed version, so restrict the admin area and stop uploads from running as code.
What's affected
The record names SourceCodester Online Computer and Laptop Store 1.0. The flawed code is /classes/SystemSettings.php, called with the function update_settings. The weakness is CWE-434. The record says the attack can start remotely and that the exploit is public. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.
NVD scores 6.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while VulDB's wording calls it critical. The KEV flag is false.
The same product has a SQL injection record, CVE-2024-4798, in the admin brand page. The two issues are separate: one lets a user store a file, the other lets request values reach a query. A site that has both has two ways in through the admin area.
How to check if you're exposed
- Find Online Computer and Laptop Store in your web roots and check for version 1.0.
- Find where the settings function stores uploaded files, and list the contents.
- Look for files with script extensions, double extensions or sizes that do not fit a logo or banner.
- Check that web server rules deny script execution in that folder.
- Review access logs for posts to the settings class.
What to do now
- Close the admin area to the internet.
- Allow only known image types, and verify the content, not the extension alone.
- Store uploads outside the web root, or serve them from a path that cannot run code.
- Remove files you do not recognise and rotate credentials.
- Review the application for a database injection issue as well, given CVE-2024-4798.
- Replace the application if you cannot maintain it.
Why it matters
Unrestricted upload is dangerous because the server stores something the attacker chose. If the server then runs or serves it, the result can range from defacement to code execution on the host.
The medium score reflects the need for a login. Many small shops reuse one admin password across tools, so the real barrier may be lower than the vector implies. Scanning the code for upload handlers before deployment is far cheaper than cleaning up afterward.
Quick check
Is a vendor fix listed?
No. The record names no fixed version and none was confirmed in the sources.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263941 (not readable without a browser session)
- NVD record data for CVE-2024-4820
Last reviewed: 19 October 2026.
