CVE-2024-10719

Description

A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0.

Reserved 2024-11-01 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version before 1.7.0
affected

References

huntr.com/bounties/56aba8cb-4da1-44b4-8c4d-c5ba00ea3670

github.com/...ommit/c1697bb6c4e4a6403d69c0868e1eb1040f98b731

cve.org (CVE-2024-10719)

nvd.nist.gov (CVE-2024-10719)

Download JSON