CVE-2024-40324

MEDIUM

E-Staff <5.1 - HTTP Response Splitting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-40324. PoCs published by aleksey-vi.

AI-analyzed exploit summary The repository describes a CRLF injection vulnerability in E-Staff v5.1, allowing attackers to manipulate HTTP headers via injected Carriage Return and Line Feed characters. The writeup outlines potential impacts like header injection, cache poisoning, and XSS but lacks functional exploit code.

Description

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP response splitting and header manipulation.

Exploits (1)

nomisec WRITEUP
by aleksey-vi · poc
https://github.com/aleksey-vi/CVE-2024-40324

The repository describes a CRLF injection vulnerability in E-Staff v5.1, allowing attackers to manipulate HTTP headers via injected Carriage Return and Line Feed characters. The writeup outlines potential impacts like header injection, cache poisoning, and XSS but lacks functional exploit code.

Classification
Writeup 80%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: E-Staff v5.1
No auth needed
Prerequisites: Access to input fields vulnerable to CRLF injection
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory
https://github.com/aleksey-vi/CVE-2024-40324

Scores

CVSS v3 5.4
EPSS 0.0064
EPSS Percentile 45.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-113 CWE-93 CWE-74
Status published
Products (1)
datex-soft/e-staff 5.1
Published Jul 25, 2024
Tracked Since Feb 18, 2026