CVE-2024-22492

Vulnerability

Overview The vulnerability is a stored cross-site scripting (XSS) issue in JFinalcms 5.0.0. The contact parameter of the /gusetbook/save endpoint does not properly sanitize user input, allowing attackers to store malicious scripts that execute when the page is viewed. [1][2]

Exploitation

Details Exploitation requires an attacker to submit a crafted payload in the contact field when saving a guestbook entry. The payload is stored and later executed when an administrator accesses the /admin/guestbook page to view entries. No special privileges are needed for the initial submission. [2]

Impact

The impact is that an attacker can execute arbitrary JavaScript in the context of an administrator's session. This can lead to session hijacking, defacement, or theft of sensitive data such as cookies. The vulnerability is classified as stored XSS with a CVSS score not yet provided but considered moderate severity. [1]

Mitigation

Status As of the publication date, no patch has been released. Users should consider disabling the guestbook feature or implementing input validation and output encoding as a workaround. The vendor has been notified via the repository. [2]