CVE-2024-39210: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-39210, organizations should implement the following specific measures: 1) Immediately restrict access to the affected application, especially the index.php Page parameter, by applying web application firewall (WAF) rules that block suspicious file path traversal or parameter manipulation attempts. 2) Implement strict input validation and sanitization on the Page parameter to allow only expected values or whitelist valid page identifiers, preventing arbitrary file access. 3) Configure the web server and PHP environment to disable directory listing and restrict file read permissions to only necessary files, minimizing exposure. 4) Isolate the application environment to limit the impact of potential data disclosure, including using containerization or sandboxing. 5) Monitor application logs and network traffic for unusual access patterns targeting the Page parameter or attempts to read sensitive files. 6) Engage with the software vendor or development team to obtain patches or updates addressing this vulnerability. 7) If patches are unavailable, consider temporarily disabling or replacing the vulnerable module or application until a secure version is deployed. 8) Educate developers on secure coding practices to prevent similar vulnerabilities in future releases.
Description
Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows attackers to read arbitrary PHP files and access other sensitive information within the application.