PT-2024-35585 · Phpmailer+1 · Phpmailer+1

Rafael Pedrero · Published 2024-05-24 · Updated 2024-05-24 · CVE-2024-5312

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PHP Server Monitor version 3.2.0

Description The issue allows for an XSS attack via the "/phpservermon-3.2.0/vendor/phpmailer/phpmailer/test script/index.php" page, where all visible parameters are vulnerable. An attacker can create a specially crafted URL and send it to a victim to potentially retrieve their session details.

Recommendations For PHP Server Monitor version 3.2.0, consider restricting access to the "/phpservermon-3.2.0/vendor/phpmailer/phpmailer/test script/index.php" page until a fix is available, and avoid using vulnerable parameters in this endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5312

GHSA-RQ7F-J68F-MQH3

Affected Products

Php Server Monitor

Phpmailer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-5312 · Security Note
• https://osv.dev/vulnerability/GHSA-rq7f-j68f-mqh3 · Vendor Advisory
• https://github.com/PHPMailer/PHPMailer/commit/ff8718f72225a2e34d918c06a3b2c8cca5af3164 · Note
• https://github.com/phpservermon/phpservermon · Note
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor · Note