Arbitrary Code Execution Vulnerability in Camaleon CMS

CVE-2024-48652

4.8MEDIUM

Key Information:

Vendor
camaleon-cms
Status
Camaleon Cms
Vendor
CVE Published:
22 October 2024

Badges

πŸ‘Ύ Exploit Exists🟑 Public PoC

Summary

A Cross Site Scripting (XSS) vulnerability exists in Camaleon CMS version 2.7.5, where an attacker can exploit the content group name field to inject and execute arbitrary code. This can lead to unauthorized actions on behalf of the user and compromise the security of the web application. Proper input validation and encoding are essential to mitigate the risks posed by this vulnerability, ensuring that user inputs are safely handled to prevent malicious exploitation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

References

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟑

    Public PoC available

  • πŸ‘Ύ

    Exploit known to exist

Collectors

NVD Database1 Proof of Concept(s)
.