CVE-2024-28734

published 2024-03-19

CVE-2024-28734: Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using…

Priority P2 79 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C N I L A L

ITW EXPLOIT VulnCheck KEV

Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter.

Detection & IOCs extracted from sources · hover to see the quote

url /coda/frameset?cols="><script>alert(1)</script>↗

path /coda/frameset

sigma

detection on HTTP GET requests to /coda/frameset with cols parameter containing script injection

• → Monitor HTTP GET requests to the /coda/frameset endpoint where the 'cols' query parameter contains HTML/script injection characters such as "> or <script> tags. ↗
• → The vulnerability is in Unit4 Financials by Coda versions prior to 2023Q4 / up to 2024Q1; flag requests from unauthenticated or low-privileged remote sources targeting this endpoint. ↗

• · The Nuclei template targets a single GET request with max-request: 1, meaning detection coverage is limited to the specific cols parameter injection pattern shown; other XSS vectors in the same application may not be covered. ↗
• · The matcher checks for the reflected payload in the body AND Content-Type text/html AND HTTP 200; WAFs or response-altering proxies may suppress the reflected payload and cause false negatives.

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

vulncheck 6.1 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79