Read the docs
TI-2024-11120 Aliases CVE-2024-11984GHSA-659x-gph6-8j4w

SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

Priority MEDIUM 44CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00762 55th percentileScored 2026-11-07
Fix Fixed Corporate Training Management System (SUNNET Technology Co., Ltd.): 10.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunnetCorporate Training Management Systembefore 10.1310.13Patch availableCNA
  • Corporate Training Management System VendorSunnet Affected before 10.13 Fixed in 10.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sun.net:ehrd_ctms:*:*:*:*:*:*:*:*——Sunnet
  • cpe:2.3:a:sun.net:ehrd_ctms:*:*:*:*:*:*:*:* Versions — — ·Sunnet

Remediation

  • Fix · CNA Corporate Training Management System (SUNNET Technology Co., Ltd.) Fixed in 10.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11984
  2. 2026-10-03 Alias added: GHSA-659x-gph6-8j4w

References

Advisory 1

  • TI-2019-08271 SUNNET WMPro v5.0 and v5.1 has OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-34665 SUNNET Corporate Training Management System - External Control of File Name or Path CVSS 4.0CRITICAL 10.0
  • TI-2024-09668 Sunnet eHRD CTMS - SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-34666 SUNNET Corporate Training Management System - SQL Injection CVSS 4.0CRITICAL 9.3
  • TI-2025-34663 SUNNET Corporate Training Management System - Missing Authorization CVSS 4.0CRITICAL 9.3
  • TI-2025-34662 SUNNET Corporate Training Management System - Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences