CVE-2024-50800
Description
Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Insufficient validation of user input in the error parameter of the login form URL allows attacker-controlled content to be embedded in the HTML response without sanitization."
Attack vector
An unauthenticated remote attacker crafts a URL containing a malicious JavaScript or HTML payload in the error parameter of the Smart4Web login page (e.g., `/smart4web/?error=<script>...</script>`). When a victim visits this crafted URL, the injected payload is reflected in the HTML response and executed in the victim's browser. The attacker can leverage this to perform phishing, redirection, content defacement, or malware distribution [CWE-79] [ref_id=1].
Affected code
The vulnerable component is the login form's error parameter in the URL path `/smart4web/` [ref_id=1]. The advisory does not specify the exact server-side file or function responsible for rendering the error parameter.
What the fix does
The advisory does not include a patch diff, but the fix is described as version 5.0 20241004 and later [ref_id=1]. The remediation involves properly neutralizing or encoding user-controllable input placed into the error parameter before it is rendered in the HTML response, preventing script execution [CWE-79].
Preconditions
- networkAttacker must be able to deliver a crafted URL to a victim (e.g., via email, link, or social engineering).
- inputThe error parameter in the URL must accept and reflect unvalidated input into the HTML response.
Reproduction
Navigate to the Smart4Web login page (`/smart4web/`) and attempt to log in with invalid credentials to trigger an error. Inject an HTML/JavaScript payload into the URL parameter immediately following `error=`. Upon visiting the crafted URL, the injected content is rendered in the HTML response [ref_id=1].
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.