Remote Code Execution via Default Keyword Field in Settings Function
CVE-2024-27752

5.4MEDIUM

Key Information:

Vendor

CSZ CMS

Status
Csz Cms
Vendor
CVE Published:
19 April 2024

What is CVE-2024-27752?

A Cross Site Scripting (XSS) vulnerability exists in CSZ CMS version 1.3.0, enabling remote attackers to execute arbitrary code by exploiting the Default Keyword field within the settings functionality. This flaw could potentially allow malicious actors to inject harmful scripts, compromising the integrity of web applications and jeopardizing user data. Security measures must be implemented to safeguard against unauthorized code execution and to fortify web application defenses.

References

https://github.com/flyhha/cms/blob/main/1.md

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.