PT-2024-15814 · Unknown · Codeastro Internet Banking System

Mohammed Aashique · Published 2024-01-22 · Updated 2024-05-17 · CVE-2024-0781

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeAstro Internet Banking System version 1.0

Description A problematic issue was found in the CodeAstro Internet Banking System, affecting an unknown part of the file pages client signup.php. The manipulation of the argument Client Full Name with the input <meta http-equiv="refresh" content="0; url=https://vuldb.com" /> leads to an open redirect. This issue can be initiated remotely.

Recommendations For CodeAstro Internet Banking System version 1.0, as a temporary workaround, consider restricting the input for the Client Full Name argument to prevent open redirect attacks. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-0781

Affected Products

Codeastro Internet Banking System

References · 7

• 🔥 https://drive.google.com/drive/folders/1f61RXqelSDY0T92aLjmb8BhgAHt_eeUS · Exploit
• https://osv.dev/vulnerability/CVE-2024-0781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0781 · Security Note
• https://vuldb.com/?ctiid.251697 · Note
• https://vuldb.com/?id.251697 · Note
• https://twitter.com/CVEnew/status/1749466947367161867 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1749485616293671019 · Twitter Post