CVE-2024-54285 is a CWE-434 vulnerability in SeedProd Pro that permits users with high privileges to upload files without proper restrictions on file types. This allows potentially dangerous files, such as web shells, to be uploaded to the server, which can lead to full system compromise. The vulnerability affects all versions up to 6.18.10. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an attacker with high privileges to upload malicious files (e.g., web shells) to the server, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in unauthorized code execution and control over the web server hosting SeedProd Pro.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions to trusted users only and consider disabling file uploads if feasible. Monitor for unusual file uploads and remove any suspicious files promptly. Follow vendor communications closely for updates on patches or official mitigations.