PT-2025-12066 · Unknown · Binary-Husky/Gpt Academic

Published 2025-03-20 · Updated 2025-07-14 · CVE-2024-10819

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version 3.83

Description A Cross-Site Request Forgery (CSRF) issue allows an attacker to trick a user into uploading files without their consent, exploiting their session. This can lead to unauthorized file uploads and potential system compromise. The uploaded file can contain malicious scripts, leading to stored Cross-Site Scripting (XSS) attacks. Through stored XSS, an attacker can steal information about the victim and perform any action on their behalf.

Recommendations For version 3.83, consider implementing proper CSRF token validation to prevent unauthorized file uploads. As a temporary workaround, restrict access to file upload functionality until a patch is available. Avoid using the file upload feature in version 3.83 until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-10819

Affected Products

Binary-Husky/Gpt Academic

References · 6

• 🔥 https://huntr.com/bounties/45270c4b-a500-4374-a90b-37b604a3ace0 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10819 · Security Note
• https://twitter.com/CVEnew/status/1902671117950636115 · Twitter Post
• https://twitter.com/cybercronai/status/1903031490071629864 · Twitter Post
• https://t.me/cvenotify/128868 · Telegram Post