GitHub Advisoryadvisory · Packagist

GHSA-j9wp-x5q5-xh2f Funadmin Cross-site Scripting vulnerability

LOW Published 2024-10-26 Modified 2024-10-28 Official page ↗

Aliases: CVE-2024-48228
Ecosystem: Packagist
Packages: funadmin/funadmin
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2024-10-28

Affected packages

• Packagist funadmin/funadmin: <= 5.0.2 (no fix yet)

Description

An issue was found in funadmin 5.0.2. The selectfiles method in `\backend\controller\sys\Attachh.php` directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).

Alias · CVE (1)

CVE-2024-48228 An issue was found in funadmin 5.0.2. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References