CVE-2024-24494
MEDIUMDaily Habit Tracker 1.0 - Stored Cross-Site Scripting via add-tracker.php and update-tracker.php Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-24494. PoCs published by Yevhenii Butenko.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Daily Habit Tracker 1.0, where malicious scripts can be injected into multiple parameters (e.g., 'day', 'exercise') and stored in the database, executing when rendered in other users' browsers.
Description
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in Daily Habit Tracker 1.0, where malicious scripts can be injected into multiple parameters (e.g., 'day', 'exercise') and stored in the database, executing when rendered in other users' browsers.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N