CVE-2024-13982

Impact

SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://blog.csdn.net/qq_36618918/article/details/135505570
• https://sponcomm.com/collections/ip-intercom-system
• https://www.vulncheck.com/advisories/spon-ip-network-intercom-system-arbitrary-file-read