CVE-2024-52305

UnoPim Stored XSS : Cookie hijacking through Create User function

State: Published
Severity: 6.5 Medium
Published: Nov 13, 2024
Updated: Nov 13, 2024
Reserved: Nov 6, 2024

Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This vulnerability is fixed in 0.1.5.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-616 Incomplete Identification of Uploaded File Variables (PHP)
CWE-692 Incomplete Denylist to Cross-Site Scripting

Affected Products

Product	Versions
unopimunopim	< 0.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.