PT-2024-15926 · Unknown · 60Indexpage

Glzjin · Published 2024-01-26 · Updated 2024-05-17 · CVE-2024-0945

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 60IndexPage versions up to 1.8.5

Description A critical issue has been found in the Parameter Handler component of the affected software, specifically in the file /include/file.php. The manipulation of the url argument leads to server-side request forgery, which can be initiated remotely. The issue has been publicly disclosed.

Recommendations For versions up to 1.8.5, consider restricting access to the vulnerable url argument in the Parameter Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-0945

Affected Products

60Indexpage

References · 7

• 🔥 https://note.zhaoj.in/share/7F54gy22y7uJ · Exploit
• https://osv.dev/vulnerability/CVE-2024-0945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0945 · Security Note
• https://vuldb.com/?id.252189 · Note
• https://twitter.com/RedPacketSec/status/1752996325719777684 · Twitter Post
• https://vuldb.com/?ctiid.252189 · Note
• https://twitter.com/CVEnew/status/1750985073426358691 · Twitter Post