CVE-2024-11680

ProjectSend versions prior to r1720 fail to enforce authentication on requests to options.php (CWE-306, missing authentication for a critical function), a critical flaw rated CVSS 9.8. A remote, unauthenticated attacker can send crafted HTTP requests directly to options.php to modify the application's configuration without any user interaction. With configuration control, the attacker can enable registration and create accounts, upload webshells to achieve code execution on the server, and embed malicious JavaScript in the site. Any organization running ProjectSend earlier than r1720 — especially internet-facing deployments used for client file exchange — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03, carries a 91.7% EPSS probability of exploitation within 30 days, and public reporting and a Metasploit module are available.

What to do: Upgrade ProjectSend to r1720 or later, which restores proper authentication on options.php; per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigation is not possible. Prioritize internet-facing instances and hunt for signs of compromise, including unexpected or new user accounts, modified configuration, unexpected PHP files or webshells on the server, and injected JavaScript. Until patched, restrict network access to the installation and limit or protect access to options.php.