PT-2025-3349 · Unknown · Codeastro Internet Banking System

Ipratheep · Published 2025-01-22 · Updated 2025-08-04 · CVE-2024-56924

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Code Astro Internet banking system version 2.0.0

Description A Cross Site Request Forgery (CSRF) vulnerability exists in Code Astro Internet banking system version 2.0.0. This allows remote attackers to execute arbitrary JavaScript on the admin page (pages account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. The vulnerability occurs due to improper validation of user requests, enabling attackers to exploit the system by tricking the admin user into executing malicious scripts.

Recommendations Code Astro Internet banking system version 2.0.0: Implement robust CSRF protection mechanisms, such as synchronizer tokens, to validate user requests and prevent unauthorized actions. Ensure all user inputs are properly validated and sanitized before processing.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-56924

Affected Products

Codeastro Internet Banking System

References · 8

• 🔥 https://github.com/ipratheep/CVE-2024-56924 · Exploit
• https://osv.dev/vulnerability/CVE-2024-56924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56924 · Security Note
• https://twitter.com/WolfgangSesin/status/1882179066582765595 · Twitter Post
• https://t.me/cveNotify/130780 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1882179066872148380 · Twitter Post
• https://t.me/cvedetector/16144 · Telegram Post
• https://twitter.com/CVEnew/status/1882300228205728031 · Twitter Post