PT-2024-16002 · Shanxi Diankeyun Technology · Noderp

Glzjin · Published 2024-01-29 · Updated 2024-05-17 · CVE-2024-1006

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shanxi Diankeyun Technology NODERP versions up to 6.0.2

Description A critical issue affects the Cookie Handler component, specifically the file application/index/common.php, due to improper authentication when manipulating the Nod User Id/Nod User Token argument. This can be exploited remotely.

Recommendations For versions up to 6.0.2, consider disabling the Cookie Handler component or restricting access to the application/index/common.php file until a patch is available. Additionally, avoid using the Nod User Id and Nod User Token arguments in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-1006

Affected Products

Noderp

References · 8

• 🔥 https://note.zhaoj.in/share/vWuVlU2eg79t · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1006 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1006 · Vendor Advisory
• https://vuldb.com/?ctiid.252275 · Note
• https://twitter.com/RedPacketSec/status/1752634097791291738 · Twitter Post
• https://t.me/cvenotify/70791 · Telegram Post
• https://vuldb.com/?id.252275 · Note
• https://t.me/cvenotify/71304 · Telegram Post