GitHub Advisoryadvisory · Packagist

GHSA-99wg-vmvq-2cp5 RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`

MEDIUM Published 2024-03-15 Modified 2025-04-10 Official page ↗
Aliases
CVE-2024-2497
Ecosystem
Packagist
Packages
billz/raspap-webgui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-94
Reviewed
2025-04-10

Affected packages

• Packagist billz/raspap-webgui: <= 3.0.9 (no fix yet)

Description

A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2024-2497 A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References