PT-2024-24521 · Boidcms · Boidcms

Antonio Díaz · Published 2024-04-17 · Updated 2025-05-05 · CVE-2024-32342

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Boid CMS version 2.1.0

Description A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Permalink parameter.

Recommendations For Boid CMS version 2.1.0, consider disabling the Create Page feature until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the Permalink parameter to minimize the risk of arbitrary web script execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32342

Affected Products

Boidcms

References · 8

• 🔥 https://github.com/adiapera/xss_create_boidcms_2.1.0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32342 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32342 · Vendor Advisory
• https://t.me/cvenotify/77229 · Telegram Post
• https://twitter.com/CVEnew/status/1781102433382568416 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1780728683554087110 · Twitter Post
• https://t.me/cvenotify/120842 · Telegram Post
• https://t.me/cvenotify/77340 · Telegram Post