CVE-2024-12183

Summary

CVE-2024-12183 is a newly identified vulnerability affecting DedeCMS 5.7.116. The issue lies within the RemoveXSS function of the /plus/carbuyaction.php file in the HTTP POST Request Handler component. By manipulating this function, an attacker can inject malicious scripts, leading to cross-site scripting (XSS) attacks. Such attacks allow unauthorized code execution in the victim's web browser, potentially resulting in data theft, session hijacking, or other malicious activities. Remotely initiating the exploit is possible, making this vulnerability a significant security risk. Public disclosure of the exploit increases the likelihood of its widespread usage.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.