CVE-2024-36679

2024-06-1900:00:00

mitre

github.com

module live chat pro

php code injection

predictable token

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

In the module “Module Live Chat Pro (All in One Messaging)” (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method Lcp::saveTranslations() suffer of a white writer that can inject PHP code into a PHP file.

References

security.friendsofpresta.org/modules/2024/06/18/livechatpro.html