A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The manipulation of the argument m2 with the input <svg%20onload=alert(document.cookie)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://code-projects.org/ | Product |
| https://github.com/sh3rl0ckpggp/0day/blob/main/code-projects_online-shop_CrossSiteScripting.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.284679 | Permissions Required |
| https://vuldb.com/?id.284679 | Third Party Advisory |
| https://vuldb.com/?submit.442075 | Third Party Advisory |
| https://youtu.be/QThAqddl5Dk | Exploit |
Configurations
History
10 Dec 2024, 17:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://code-projects.org/ - Product | |
| References | () https://youtu.be/QThAqddl5Dk - Exploit | |
| References | () https://vuldb.com/?id.284679 - Third Party Advisory | |
| References | () https://github.com/sh3rl0ckpggp/0day/blob/main/code-projects_online-shop_CrossSiteScripting.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?submit.442075 - Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.284679 - Permissions Required | |
| First Time |
Code-projects
Code-projects online Shop Store |
|
| CPE | cpe:2.3:a:code-projects:online_shop_store:1.0:*:*:*:*:*:*:* | |
| CWE | ||
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
15 Nov 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-15 15:15
Updated : 2024-12-10 17:29
NVD link : CVE-2024-11243
Mitre link : CVE-2024-11243
JSON object : View
Products Affected
code-projects
- online_shop_store
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')