CVE-2024-56924 Cross-site request forgery in n/a
Attackers can trick admins into executing malicious scripts via CSRF, leading to unauthorized account changes or data theft in the banking system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-56924?
CVE-2024-56924 is a high-severity vulnerability in n/a, published on 22 Jan 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. This vulnerability occurs due to improper validation of user requests, which enables attackers to exploit the system by tricking the admin user into executing malicious scripts.
Weakness: CWE-352
Which versions are affected by CVE-2024-56924?
It affects 1 product.
Products include Codeastro Internet Banking System.
How do I fix CVE-2024-56924?
No fix has been published for CVE-2024-56924 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-56924 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-56924 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rj2q-jjmp-m73j.