PT-2024-37113 · Joomla · Admirorframes

Sectroyer · Published 2024-06-28 · Updated 2024-07-03 · CVE-2024-5737

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions: AdmirorFrames versions prior to 5.0

Description: The issue affects the AdmirorFrames Joomla! extension, specifically the afGdStream.php script, which fails to specify a content type, resulting in the default text/html type being used. This allows an attacker to embed HTML tags directly in image data, which can be rendered by a webpage as HTML.

Recommendations: For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the afGdStream.php script until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5737

Affected Products

Admirorframes

References · 7

• 🔥 https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5737 · Exploit
• 🔥 https://github.com/afine-com/CVE-2024-5737 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5737 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5737 · Vendor Advisory
• https://github.com/vasiljevski/admirorframes/issues/3 · Note
• https://cert.pl/en/posts/2024/06/CVE-2024-5735 · Note
• https://cert.pl/posts/2024/06/CVE-2024-5735 · Note