THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4993

SQL injection vulnerability in SiAdmin

Reserved:2024-05-16
Published:2024-05-16
Updated:2024-05-16

Description

Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.



MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

1.1
affected

Credits

Rafael Pedrero finder

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-siadmin

cve.org CVE-2024-4993

nvd.nist.gov CVE-2024-4993

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4993