CVE-2024-6526 CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting

Medium 5.3 Published 5 Jul 2024 Updated 1 Aug 2024

Remote attackers can inject malicious scripts via search parameters in CodeIgniter Ecommerce-CodeIgniter-Bootstrap, potentially leading to session hijacking or code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-6526?

CVE-2024-6526 is a medium-severity cross-site scripting vulnerability in Ecommerce-CodeIgniter-Bootstrap, published on 5 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2024-6526?

It affects 1 product.

Products include Ecommerce-Codeigniter-Bootstrap Project Ecommerce-Codeigniter-Bootstrap.

How do I fix CVE-2024-6526?

No fix has been published for CVE-2024-6526 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-6526 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6526 exists.

Sources

Also known as GHSA-5fc5-2cqx-72pm.