CVE-2024-53255CWE-79

Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS

Medium · published November 25, 2024

CVSS v4.0
5.3
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00889 · 58.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-25T19:01Z
EPSS history
Timeline
  • 25 NOV 19:01Z
    Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
    cvelistv5