CVE-2024-11660: XSS in Farmacia 1.0

Successful exploitation of CVE-2024-11660 enables an attacker to inject arbitrary JavaScript code into the Farmacia application. This code can then be executed in the context of a victim's browser, allowing the attacker to steal session cookies, redirect users to malicious websites, or modify the content displayed on the page. The impact is heightened by the remote nature of the attack, meaning an attacker doesn't need local access to exploit the vulnerability. The blast radius extends to all users interacting with the vulnerable 'usuario.php' endpoint, potentially impacting a wide range of Farmacia users.

1. Reserved2024-11-24
2. Published2024-11-25
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-11660 is to upgrade Farmacia to version 1.0.1, which includes a fix for the XSS vulnerability. If an immediate upgrade is not feasible, consider implementing input validation and sanitization on the 'name' parameter in 'usuario.php' to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the 'name' parameter and verifying that it is properly sanitized or blocked.