Arbitrary Code Execution Vulnerability in Camaleon CMS
CVE-2024-48652

4.8MEDIUM

Key Information:

Vendor

camaleon-cms

Status
Camaleon Cms
Vendor
CVE Published:
22 October 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 28%

What is CVE-2024-48652?

A Cross Site Scripting (XSS) vulnerability exists in Camaleon CMS version 2.7.5, where an attacker can exploit the content group name field to inject and execute arbitrary code. This can lead to unauthorized actions on behalf of the user and compromise the security of the web application. Proper input validation and encoding are essential to mitigate the risks posed by this vulnerability, ensuring that user inputs are safely handled to prevent malicious exploitation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-48652
Created by paragbagul111

References

https://github.com/paragbagul111/CVE-2024-48652/

EPSS Score

28% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

JSON
.
CVE-2024-48652 : Arbitrary Code Execution Vulnerability in Camaleon CMS