Arbitrary Code Execution Vulnerability in Camaleon CMS
CVE-2024-48652
4.8MEDIUM
Key Information:
- Vendor
- camaleon-cms
- Status
- Camaleon Cms
- Vendor
- CVE Published:
- 22 October 2024
Badges
πΎ Exploit Existsπ‘ Public PoC
Summary
A Cross Site Scripting (XSS) vulnerability exists in Camaleon CMS version 2.7.5, where an attacker can exploit the content group name field to inject and execute arbitrary code. This can lead to unauthorized actions on behalf of the user and compromise the security of the web application. Proper input validation and encoding are essential to mitigate the risks posed by this vulnerability, ensuring that user inputs are safely handled to prevent malicious exploitation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
- π‘
Public PoC available
- πΎ
Exploit known to exist
Collectors
NVD Database1 Proof of Concept(s)