Lucene search
HistoryJun 19, 2024 - 9:15 p.m.
CVE-2024-36679
module live chat pro
php code injection
predictable token
CVSS3
10
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
0
Percentile
9.0%
In the module “Module Live Chat Pro (All in One Messaging)” (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method Lcp::saveTranslations() suffer of a white writer that can inject PHP code into a PHP file.
Related
cvelist
cvelist
CVE-2024-36679
2024-06-19 00:00:00
cve
cve
CVE-2024-36679
2024-06-19 21:15:57
vulnrichment
vulnrichment
CVE-2024-36679
2024-06-19 00:00:00
CVSS3
10
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
0
Percentile
9.0%
Related for NVD:CVE-2024-36679