PT-2024-26484 · Unknown · Campcodes Church Management System

Ssl_Seven_Security Lab_Wangzhiqiang_Xiaozilong · Published 2024-04-10 · Updated 2025-02-19 · CVE-2024-3541

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Campcodes Church Management System version 1.0

Description A problematic vulnerability has been found in the system, affecting an unknown part of the file /admin/admin user.php. The manipulation of the firstname argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Campcodes Church Management System version 1.0, consider disabling the firstname argument in the /admin/admin user.php file as a temporary workaround until a patch is available. Restrict access to the /admin/admin user.php file to minimize the risk of exploitation. Avoid using the firstname argument in the affected file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3541

Affected Products

Campcodes Church Management System

References · 10

• 🔥 https://github.com/E1CHO/cve_hub/blob/main/Church%20Management%20System/Church%20Management%20System%20-%20vuln%208.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3541 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3541 · Vendor Advisory
• https://t.me/cvenotify/76291 · Telegram Post
• https://t.me/cvenotify/111804 · Telegram Post
• https://vuldb.com/?submit.312542 · Note
• https://vuldb.com/?ctiid.259911 · Note
• https://twitter.com/CVEnew/status/1778263658168193371 · Twitter Post
• https://vuldb.com/?id.259911 · Note
• https://twitter.com/VulmonFeeds/status/1778010000524230679 · Twitter Post