プラットフォーム
php
修正版
1.0.1
CVE-2024-12790 describes a cross-site scripting (XSS) vulnerability discovered in the Hostel Management Site version 1.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability affects the room-details.php file and can be exploited remotely. A fix is available in version 1.0.1.
Successful exploitation of CVE-2024-12790 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Hostel Management Site. This can lead to various malicious actions, including stealing session cookies, redirecting users to phishing sites, defacing the website, or injecting malware. The impact is amplified if the site handles sensitive user data, such as booking information or personal details, as an attacker could potentially access or modify this data. While the CVSS score is LOW, the potential for user compromise and data theft makes this a significant concern.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. No known active campaigns targeting this specific CVE have been reported as of the publication date. Public proof-of-concept exploits are likely to emerge given the ease of exploiting XSS vulnerabilities. The vulnerability is tracked by NVD and CISA.
Hostel Management Site users running version 1.0 are at direct risk. Shared hosting environments where multiple websites share the same server are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others. Users who have not implemented robust input validation and output encoding practices are also at increased risk.
• php / web:
grep -r "<script" /var/www/html/hostel-management-site/room-details.php• generic web:
curl -I http://your-hostel-site.com/room-details.php?param=<script>alert('XSS')</script>• generic web:
curl 'http://your-hostel-site.com/room-details.php?param=<script>alert(document.domain)</script>' -s -o /dev/null -w '%{http_code}
'disclosure
エクスプロイト状況
EPSS
0.11% (30% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation for CVE-2024-12790 is to upgrade the Hostel Management Site to version 1.0.1, which contains the necessary fix. If upgrading immediately is not possible, consider implementing input validation and output encoding on the room-details.php page to sanitize user-supplied data. While not a complete solution, this can reduce the attack surface. Regularly review and update all third-party libraries and dependencies to ensure they are free of known vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) into the room-details.php page and verifying that the script does not execute.
パッチが適用されたバージョンにアップデートするか、XSS コードの実行を避けるために必要なセキュリティ対策を適用してください。room-details.php ファイルでユーザー入力を検証およびサニタイズして、悪意のあるスクリプトのインジェクションを防ぎます。PHP のセキュリティフレームワークの実装を検討してください。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2024-12790 is a cross-site scripting (XSS) vulnerability affecting Hostel Management Site version 1.0, allowing attackers to inject malicious scripts via the room-details.php file.
Yes, if you are running Hostel Management Site version 1.0, you are vulnerable to this XSS attack. Upgrade to version 1.0.1 to mitigate the risk.
The recommended fix is to upgrade to version 1.0.1. As a temporary workaround, implement input validation and output encoding on the affected page.
While no active campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the likelihood of exploitation. Monitor your systems closely.
Refer to the project's official website or repository for the advisory related to CVE-2024-12790. Check their release notes for details.
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。