CVE-2024-50348 InstantCMS has a Cross Site Scripting Vulnerability
Attackers can inject XSS payloads via the photo upload function in InstantCMS, potentially executing malicious scripts in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-50348?
CVE-2024-50348 is a medium-severity cross-site scripting vulnerability in instantsoft icms2, published on 29 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3.
Weakness: CWE-79
Which versions are affected by CVE-2024-50348?
It affects 1 product.
Products include Instantcms Instantcms.
How do I fix CVE-2024-50348?
No fix has been published for CVE-2024-50348 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-50348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50348 exists.
Other vulnerabilities in instantsoft icms2
- CVE-2023-4188 SQL Injection in instantsoft/icms2
- CVE-2013-10051 InstantCMS <= 1.6 Remote PHP Code Execution
- CVE-2023-4704 External Control of System or Configuration Setting in instantsoft/icms2
- CVE-2026-28281 InstantCMS has Multiple CSRF Vulnerabilities
- CVE-2023-4652 Cross-site Scripting (XSS) - Stored in instantsoft/icms2
Sources
Also known as GHSA-f6cf-jg84-fw29.