CVE-2024-24573 facileManager Privilege Escalation via Mass Assignment
Attackers can escalate privileges to super user by manipulating profile update requests, allowing unauthorized administrative control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24573?
CVE-2024-24573 is a high-severity vulnerability in WillyXJ facileManager, published on 31 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.
Weakness: CWE-863
Which versions are affected by CVE-2024-24573?
It affects 1 product.
Products include Facilemanager Facilemanager.
How do I fix CVE-2024-24573?
No fix has been published for CVE-2024-24573 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-24573 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24573 exists.
Other vulnerabilities in WillyXJ facileManager
- CVE-2026-30918 facileManager Affected by Reflected Cross-Site Scripting (XSS)
- CVE-2026-30919 facileManager Affected by Stored Cross-Site Scripting (XSS)
- CVE-2024-24572 facileManager Authenticated Variable Manipulation leading to SQL Injection
- CVE-2024-24571 facileManager Systemic Cross-Site Scripting (XSS)
Sources
Also known as GHSA-w67q-pp62-j4pf.