CVE-2024-2497: RaspAP raspap-webgui HTTP POST Request provider.php code injection
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2497?
CVE-2024-2497 is classified as a critical vulnerability.
What component is affected by CVE-2024-2497?
The vulnerability affects the HTTP POST Request Handler in the file includes/provider.php.
What can be exploited in CVE-2024-2497?
An attacker can exploit CVE-2024-2497 by manipulating the 'country' argument to achieve code injection.
How do I fix CVE-2024-2497?
To fix CVE-2024-2497, update to the latest version of RaspAP raspap-webgui that addresses this vulnerability.
What are the implications of CVE-2024-2497?
The implications of CVE-2024-2497 include potential remote code execution due to code injection vulnerabilities.