CVE-2024-45799 Javascript Injection in Vending Info/Buyers Info Module in FluxCP
Attackers can execute arbitrary JavaScript via unsanitized shop names, stealing session info from logged-in users of the FluxCP web control panel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45799?
CVE-2024-45799 is a high-severity cross-site scripting vulnerability in rathena FluxCP, published on 16 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-45799?
It affects 1 product.
Products include Rathena Fluxcp.
How do I fix CVE-2024-45799?
No fix has been published for CVE-2024-45799 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-45799 being exploited?
There is no known exploitation of CVE-2024-45799 in the wild and no public exploit code.
Other vulnerabilities in rathena FluxCP
Sources
Also known as GHSA-xvqv-25vf-88g4.