github.compatch
https://github.com/jeanmarc77/123solar/commit/94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f CVE-2024-9007
MEDIUMNuclei
jeanmarc77 123solar detailed.php cross site scripting
Record summary
CVE-2024-9007 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 20, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
123solarBrowse jeanmarc77 / 123solarDefault status: unknown | CVE List | 1.8.4.5 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUM123Solar 1.8.4.5 - Cross-Site ScriptingCVSS 6.1
123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting (XSS) via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
Impact
Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities.
Remediation
Update 123Solar to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the date1 parameter in detailed.php.
WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024xss123solarvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:123solar:123solar:1.8.4.5:*:*:*:*:*:*:*
Shodan: title:"123Solar"
FOFA: title="123Solar"
Source: ProjectDiscovery
References
6github.comexploitissue tracking
https://github.com/jeanmarc77/123solar/issues/73 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-9007 VDB-278163 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.278163 VDB-278163 | jeanmarc77 123solar detailed.php cross site scriptingvdb entryTechnical description
https://vuldb.com/?id.278163 Submit #408299 | 123Solar 1.8.4.5 Cross Site ScriptingThird-party advisory
https://vuldb.com/?submit.408299