PT-2024-33043 · Mipjz · Mipjz

Lvzcho · Published 2024-10-25 · Updated 2024-10-30 · CVE-2024-48232

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mipjz version 5.0.5

Description A Server-side request forgery (SSRF) vulnerability exists due to the improper handling of the postAddress parameter in the mipPost method of the ApiAdminTool.php file. This allows an attacker to read server files by directly passing the postAddress value into curl exec execution and output.

Recommendations For mipjz version 5.0.5, as a temporary workaround, consider validating and sanitizing the postAddress parameter to prevent unauthorized access to server files. Restrict the use of the curl exec function to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-48232

Affected Products

Mipjz

References · 4

• 🔥 https://github.com/sansanyun/mipjz/issues/17 · Exploit
• https://osv.dev/vulnerability/CVE-2024-48232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48232 · Security Note
• https://t.me/cvedetector/8986 · Telegram Post