CVE-2024-53255 Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
Attackers can inject arbitrary JavaScript via the file parameter in the media admin page, potentially stealing session cookies or defacing the site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-53255?
CVE-2024-53255 is a medium-severity cross-site scripting vulnerability in BoidCMS, published on 25 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-53255?
It affects 1 product.
Products include Boidcms Boidcms.
How do I fix CVE-2024-53255?
No fix has been published for CVE-2024-53255 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-53255 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53255 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in BoidCMS
Sources
Also known as GHSA-7q7m-cgw8-px4r.