ProjectSend Improper Authentication Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Nov 26, 2024 · Catalog

   Detected

   ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

2. Dec 3, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Dec 24, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jul 14, 2026 · Catalog

   Updated

   ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Affected

• cpe projectsend/projectsendversion unspecified
• vendor ProjectSend ProjectSendversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2024-11680

  ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-11680

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-11680

  30-day exploitation probability 91.8%

  first.org
• Metasploit ModulesPublic exploit moduleexploit_linux/http/projectsend_unauth_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2024-11680

  ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful

  nvd.nist.gov

References

• Broken Link · github.com
• CISA note · github.com
• Exploit · github.com
• CISA note · nvd.nist.gov
• Third Party Advisory · vulncheck.com
• US Government Resource · cisa.gov
• Mitigation · synacktiv.com