LINZHAOGUAN PB-CMS up to 2.0.1 Edit Article XSS Vulnerability (CVE-2024-10478)

Key Information Vulnerability Description Vulnerability ID: VDB-282089, CVE-2024-10478 Vulnerability Name: LINZHAOGUAN PB-CMS UP TO 2.0.1 EDIT ARTICLE /ADMIN#ARTICLE/EDIT?ID=2 CROSS SITE SCRIPTING Affected Versions: LINZHAOGUAN pb-cms up to 2.0.1 Affected Component: Edit Article Handler Issue Description: The Edit Article Handler component in the unknown section of the file is flawed, leading to a Cross-Site Scripting (XSS) vulnerability. CVSS Meta Temp Score Score: 2.3 Current Exploit Price Price Range: $0-$5k CTI Interest Score Score: 1.38 Impact Issue Type: Vulnerability Severity: Issue Impact: The Edit Article Handler component in the unknown section of the file is flawed, leading to a Cross-Site Scripting (XSS) vulnerability. Impact Scope: Integrity impact. CVE Description Issue Description: The Edit Article Handler component in the unknown section of the file is flawed, leading to a Cross-Site Scripting (XSS) vulnerability. Issue Type: Vulnerability Severity: Issue Impact: The Edit Article Handler component in the unknown section of the file is flawed, leading to a Cross-Site Scripting (XSS) vulnerability. Public Disclosure Disclosure Date: 2024 Disclosure Platform: gitee.com Disclosure ID: CVE-2024-10478 Exploit Difficulty Exploit Difficulty: Easy Exploit Method: Remote exploitation Required Privileges: Requires additional level of successful authentication Technical Details: Known Public Exploit: Known MITRE ATT&CK: Technique T1059.007 Exploit Tools Exploit Tool: gitee.com Claim: Proof of Concept Mitigation Recommendation: Replace the affected component. Related Vulnerabilities Related Vulnerability ID: VDB-187495 Summary This vulnerability is a Cross-Site Scripting (XSS) flaw affecting the article editing functionality in LINZHAOGUAN PB-CMS. The vulnerability resides in the Edit Article Handler component within the unknown section of the file , allowing malicious exploitation of user-controlled input during output rendering. The exploit difficulty is low, and the vulnerability has been publicly disclosed. Affected users are advised to take immediate defensive measures.

Goal Reached Thanks to every supporter — we hit 100%!

LINZHAOGUAN PB-CMS up to 2.0.1 Edit Article XSS Vulnerability (CVE-2024-10478)