Dingfangzu scripts/order.js XSS Vulnerability (CVE-2024-9077)

Key Information Vulnerability Description Vulnerability ID: VDB-278244 - CVE-2024-9077 Affected Versions: dingfangzu up to 29d67d9044f6f93378e6eb6ff92272217ff7225c Affected Component: scripts/order.js Affected Function: Unknown function Vulnerability Type: Cross Site Scripting (XSS) CWE ID: CWE-79 Impact: Affects Integrity Vulnerability Impact CVSS Meta Temp Score: 3.3 Current Exploit Price: $0-$5k CTI Interest Score: 2.23 Vulnerability Details Description: The parameter in the unknown function within is vulnerable to malicious input, leading to a Cross Site Scripting (XSS) attack. Impact: User-controllable input is not properly neutralized or is not neutralized at all, resulting in output being used by other users. Disclosure: Publicly disclosed, potentially exploitable. Version: Unknown; no detailed information provided about affected or updated versions. Contact: Vendor did not respond after disclosure. Additional Information Public Disclosure: Disclosed via GitHub. Exploit Difficulty: Easy Exploit Method: Requires user interaction Technical Details: Known Public Exploit: Known MITRE ATT&CK: T1059.007 Public Exploit: Released as proof-of-concept (PoC). Exploit Availability Exploit Method: Exploit tool available for public download via GitHub. Summary This vulnerability is a Cross Site Scripting (XSS) flaw affecting the parameter in the file, which is part of an unknown function. The affected version range is broad, and no specific details about affected or patched versions are provided. The vulnerability has been publicly disclosed and may already be exploited, though the vendor has not responded. Exploitation is relatively easy, technical details are known, and public exploits exist.

Goal Reached Thanks to every supporter — we hit 100%!

Dingfangzu scripts/order.js XSS Vulnerability (CVE-2024-9077)