CVE-2024-50861

Published: Jan 14, 2025Modified: Jun 6, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.

Affected (1)

Products: Gestioip: Gestioip

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gestioip Gestioip	Version 3.5.7

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://www.gestioip.net

Source: cve@mitre.org

Product

https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/muebel/gestioip-docker-compose

Source: cve@mitre.org

Product

https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.