PT-2025-12066 · Unknown · Binary-Husky/Gpt Academic

CVE-2024-10819 · Publicado 2025-03-20 · Atualizado 2025-07-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version 3.83

Description A Cross-Site Request Forgery (CSRF) issue allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.

Recommendations For version 3.83, consider implementing proper CSRF token validation to prevent unauthorized file uploads. As a temporary workaround, restrict access to file upload functionality until a patch is available. Avoid using the file upload feature in version 3.83 until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2024-10819

Produtos afetados

Binary-Husky/Gpt Academic

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10819.json · Exploit
• 🔥 https://huntr.com/bounties/45270c4b-a500-4374-a90b-37b604a3ace0 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10819 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1902671117950636115 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-10819 · Nota de Segurança
• https://t.me/cvenotify/128868 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1903031490071629864 · Publicação no Twitter