PT-2024-35694 · Boidcms · Boidcms

0X4M3R · Published 2024-11-25 · Updated 2024-11-27 · CVE-2024-53255

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BoidCMS versions prior to 2.1.2

Description A reflected Cross-site Scripting (XSS) issue exists in the "admin?page=media" endpoint, specifically in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This could lead to stealing the user's session cookie, performing phishing attacks, or defacing the website.

Recommendations For versions prior to 2.1.2, upgrade to version 2.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the "/admin?page=media" endpoint to minimize the risk of exploitation. Avoid using the file parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53255

GHSA-7Q7M-CGW8-PX4R

Affected Products

Boidcms

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53255.json · Exploit
• https://github.com/BoidCMS/BoidCMS/commit/42f4d703a87f5199bbd701b3495a26c91b9cfab7 · Patch
• https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-7q7m-cgw8-px4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53255 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53255 · Vendor Advisory
• https://twitter.com/CVEnew/status/1861128999402979720 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1861874025250635814 · Twitter Post