CVE-2024-12930: XSS in Simple Admin Panel 1.0

The XSS vulnerability in Simple Admin Panel allows an attacker to inject arbitrary JavaScript code into the application. Successful exploitation could lead to session hijacking, defacement of the admin panel, or redirection of users to malicious websites. The attacker would need to craft a malicious request that includes a specially crafted c_name parameter. The impact is amplified if the admin panel is used to manage sensitive data or control critical system functions. While the CVSS score is LOW, the potential for user interaction and subsequent compromise makes this a notable security concern.

1. Reserved2024-12-25
2. Published2024-12-26
3. Modified2024-12-27
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-12930 is to upgrade Simple Admin Panel to version 1.0.1, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the cname parameter within the addCatController.php file. This could involve restricting the allowed characters or encoding user-supplied input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious requests containing unusual characters in the cname parameter.