CVE-2024-50858

HIGH

GestioIP 3.5.7 - Cross-Site Request Forgery

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-50858. PoCs published by Maximiliano Belino.

AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in GestioIP 3.5.7, allowing an attacker to execute actions through an authenticated admin's browser by tricking them into visiting a malicious URL. The provided HTML payload modifies a user's privileges to administrator level.

Description

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.

Exploits (1)

exploitdb WORKING POC

by Maximiliano Belino · textremotemultiple

https://www.exploit-db.com/exploits/52200

View Code ZIP pw:eip

This exploit demonstrates a CSRF vulnerability in GestioIP 3.5.7, allowing an attacker to execute actions through an authenticated admin's browser by tricking them into visiting a malicious URL. The provided HTML payload modifies a user's privileges to administrator level.

Classification

Working Poc 100%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: GestioIP v3.5.7

Auth required

Prerequisites: Admin user must be authenticated in GestioIP · User Management option must be enabled · Attacker must host the malicious HTML file on a controlled server

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →