PT-2024-39546 · Unknown · Kalvingit Kvf-Admin

Vientiane · Published 2024-09-27 · Updated 2024-10-07 · CVE-2024-9291

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff

Description A problematic vulnerability has been found in the XML File Handler component of kalvinGit kvf-admin. The issue affects an unknown function of the file "/ueditor/upload?configPath=ueditor/config.json&action=uploadfile". The manipulation of the upfile argument leads to cross-site scripting. This can be launched remotely. The exploit has been disclosed to the public and may be used. The product uses a rolling release for continuous delivery, and no version details for affected or updated releases are available. The GitHub repository of the project has not received an update for more than two years.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9291

Affected Products

Kalvingit Kvf-Admin

References · 9

• 🔥 https://github.com/user-attachments/files/17058501/kvf-admin_xss.md · Exploit
• 🔥 https://github.com/daxiangya/kvf-admin/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9291 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9291 · Vendor Advisory
• https://vuldb.com/?submit.411202 · Note
• https://t.me/cvedetector/6582 · Telegram Post
• https://vuldb.com/?id.278784 · Note
• https://t.me/cvenotify/97300 · Telegram Post
• https://vuldb.com/?ctiid.278784 · Note