PT-2024-37112 · Joomla · Admirorframes

Sectroyer · Published 2024-06-28 · Updated 2024-07-03 · CVE-2024-5736

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0

Description: The issue is related to a Server Side Request Forgery (SSRF) vulnerability in the AdmirorFrames Joomla! extension, specifically in the afGdStream.php script. This vulnerability allows access to local files or server pages that are only available from localhost.

Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the afGdStream.php script until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-5736

Affected Products

Admirorframes

References · 8

• 🔥 https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5736 · Exploit
• 🔥 https://github.com/afine-com/CVE-2024-5736 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5736 · Security Note
• https://t.me/cvenotify/85109 · Telegram Post
• https://github.com/vasiljevski/admirorframes/issues/3 · Note
• https://cert.pl/en/posts/2024/06/CVE-2024-5735 · Note
• https://cert.pl/posts/2024/06/CVE-2024-5735 · Note