Cross-Site Scripting Vulnerability in Code-Projects Farmacia 1.0
CVE-2024-11995
Key Information
- Vendor
- Code-projects
- Status
- Farmacia
- Vendor
- CVE Published:
- 29 November 2024
Badges
Summary
CVE-2024-11995 identifies a significant cross-site scripting (XSS) vulnerability within code-projects Farmacia 1.0, specifically in the file /pagamento.php. This flaw occurs due to improper handling of user-supplied input in the 'total' argument, allowing attackers to execute malicious scripts in the browser of an unsuspecting user. The exploit is remotely actionable, enabling attackers to compromise the integrity and confidentiality of user sessions. This vulnerability has been publicly disclosed, raising concerns about the potential for widespread exploitation across impacted installations.
Affected Version(s)
Farmacia = 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
Vulnerability Reserved
- π‘
Public PoC available
- πΎ
Exploit known to exist
Vulnerability published