PT-2025-2878 · Adportal · Adportal

Published 2025-01-07 · Updated 2025-06-24 · CVE-2024-50658

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AdPortal version 3.0.39

Description A Server-Side Template Injection (SSTI) issue was found, allowing a remote attacker to execute arbitrary code via the shippingAsBilling and firstname parameters in the updateuserinfo.html file.

Recommendations For AdPortal version 3.0.39, consider disabling the shippingAsBilling and firstname parameters in the updateuserinfo.html file as a temporary workaround until a patch is available. Restrict access to the updateuserinfo.html file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-50658

Affected Products

Adportal

References · 9

• https://osv.dev/vulnerability/CVE-2024-50658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50658 · Security Note
• https://twitter.com/VulmonFeeds/status/1876744255193928099 · Twitter Post
• https://t.me/cvedetector/14598 · Telegram Post
• http://adportal.com · Note
• https://t.me/cvenotify/126432 · Telegram Post
• https://petercipolone.info/wp-content/uploads/2025/01/iPublishMedia_AdPortal3.0.39_CVEs.pdf · Note
• https://twitter.com/CVEnew/status/1876953360596660632 · Twitter Post
• http://ipublish.com · Note