CVE-2024-45799: Javascript Injection in Vending Info/Buyers Info Module in FluxCP
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45799?
CVE-2024-45799 is rated as a high severity vulnerability due to its potential to execute arbitrary JavaScript in a user's browser.
How do I fix CVE-2024-45799?
To fix CVE-2024-45799, update FluxCP to version 1.3 or later where input sanitization is implemented for shop names and vendor listings.
What types of systems are affected by CVE-2024-45799?
CVE-2024-45799 affects FluxCP versions up to and including 1.3 that are used with rAthena servers.
What are the risks of CVE-2024-45799?
The risks of CVE-2024-45799 include the potential for malicious users to inject and execute harmful JavaScript in victims' browsers.
Does CVE-2024-45799 require user interaction to be exploited?
Yes, CVE-2024-45799 requires user interaction, as it can be triggered simply by visiting the affected shop pages.