CVE-2024-45799

Javascript Injection in Vending Info/Buyers Info Module in FluxCP

State: Published
Severity: 7.3 High
Published: Sep 16, 2024
Updated: Sep 16, 2024
Reserved: Sep 9, 2024

Description

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
FluxCPrathena	< 1.3Affected

References

https://github.com/rathena/FluxCP/security/advisories/GHSA-xvqv-25vf-88g4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.