CVE-2024-1522 Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

PT-2024-2416 · Parisneo +1 · Lollms-Webui +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version v9.8 Description: The issue is related to the missing client id parameter in lollms binding infos, leading to security vulnerabilities. Specifically, the endpoints "/reload binding", "/install binding", "/reinsta...