CVE-2024-3001
published 2024-03-27CVE-2024-3001: A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.77%
51.2th percentile
A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the file /Product.php. The manipulation of the argument value leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258203.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anisha | online_book_system | — | — |
| code-projects | online_book_system | — | — |
| ghost | ghost | 0 – 5.76.0 | — |
| lobehub | chat | >= 0 < 1.19.13 | 1.19.13 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa9.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
ghsa·2024-09-23·CVSS 9.0
CVE-2024-47066 [CRITICAL] CWE-918 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
### Summary
SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address.
### PoC
1. Run lobe-chat in docker container. In my setup lobe-chat runs on 0.0.0.0:3210;
2. Create file dummy-server.js with the following content:
```
var http = require('http');
console.log("running server");
http.createServer(function (req, res) {
console.log(req.url);
res.writeHead(200, {'Content-Type': 'text/html'});
res.end();
}).listen(3001, 'localhost');
```
And run
```
node dummy-server.js
```
as an example
GHSA
GHSA-wvr8-vgg8-mqj5: A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1
ghsa_unreviewed·2024-03-28
CVE-2024-3001 [MEDIUM] CWE-89 GHSA-wvr8-vgg8-mqj5: A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1
A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the file /Product.php. The manipulation of the argument value leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258203.
GHSA
Ghost has possible Cross-site Scripting issue
ghsa·2024-02-11
CVE-2024-23724 [MEDIUM] CWE-79 Ghost has possible Cross-site Scripting issue
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%203.mdhttps://vuldb.com/?ctiid.258203https://vuldb.com/?id.258203https://vuldb.com/?submit.305055https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%203.mdhttps://vuldb.com/?ctiid.258203https://vuldb.com/?id.258203https://vuldb.com/?submit.305055
2024-03-27
Published