CVE-2024-58344

Carbon Forum 5.9.0 Persistent XSS via Forum Name Field

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Productos afectados

94Cb · Carbon Forum

PoCs públicas encontradas — 1

cve_referencewww.exploit-db.com/exploits/52043no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/lincanbin/Carbon-Forum https://www.94cb.com/https://www.exploit-db.com/exploits/52043 https://www.vulncheck.com/advisories/carbon-forum-persistent-xss-via-forum-name-field