07FLYCMS 1.3.8 System Settings Login Interface XSS Vulnerability (CVE-2024-9856)

Key Information Vulnerability Name: 07FLYCMS/07FLY-CMS/07FLYCRM 1.3.8 System Settings Page Login Interface Copyright Cross Site Scripting Vulnerability ID: VDB-280052 - CVE-2024-9856 Affected Versions: 07FLYCMS, 07FLY-CMS, 07FLYCRM 1.3.8 Vulnerability Description: Issue Type: Cross Site Scripting (XSS) Affected Component: System Settings Page Root Cause: The vulnerability exists in the login interface of the system settings page. By manipulating the "Login Interface Copyright" parameter, malicious scripts can be injected. Impact: May lead to user data leakage and execution of malicious scripts. Vulnerability Rating: CVSS Meta Temp Score: 2.3 CTI Interest Score: 1.92 Vulnerability Impact: Vulnerability Type: XSS Affected Components: 07FLYCMS, 07FLY-CMS, 07FLYCRM 1.3.8 Impact Level: May result in user data leakage and execution of malicious scripts. Vulnerability Disclosure: Disclosure Date: 2024 Disclosure Platform: GitHub Vulnerability ID: CVE-2024-9856 Exploitation Details: Exploitation Difficulty: Easy Exploitation Method: Remote exploitation Exploitation Requirements: User interaction required Exploitation Technique: T1059.007 Exploitation Tools: Exploitation Tool: GitHub Exploitation Status: Proof of Concept Recommended Actions: Recommendation: Upgrade to the latest version or switch to an alternative product. Additional Information: Affected Scope: 07FLYCMS, 07FLY-CMS, 07FLYCRM Impact Level: May result in user data leakage and execution of malicious scripts. Summary This vulnerability is a severe Cross-Site Scripting (XSS) flaw present in the login interface of the system settings page in 07FLYCMS, 07FLY-CMS, and 07FLYCRM 1.3.8. By manipulating the "Login Interface Copyright" parameter, attackers can inject malicious scripts, potentially leading to user data leakage and unauthorized script execution. The vulnerability has been publicly disclosed and can be exploited using proof-of-concept tools available on GitHub. Affected users are advised to upgrade to the latest version or switch to an alternative product.

Goal Reached Thanks to every supporter — we hit 100%!

07FLYCMS 1.3.8 System Settings Login Interface XSS Vulnerability (CVE-2024-9856)