CVE-2024-48228

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48228
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/funadmin/funadmin/issues/31 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:funadmin:funadmin:5.0.2:*:*:*:*:*:*:*
History

10 Jun 2025, 18:46

Type Values Removed Values Added
First Time Funadmin funadmin
Funadmin
References () https://github.com/funadmin/funadmin/issues/31 - () https://github.com/funadmin/funadmin/issues/31 - Exploit, Issue Tracking
CPE cpe:2.3:a:funadmin:funadmin:5.0.2:*:*:*:*:*:*:*

28 Oct 2024, 20:35

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

28 Oct 2024, 13:58

Type Values Removed Values Added
Summary
  • (es) Se encontró un problema en funadmin 5.0.2. El método selectfiles en \backend\controller\sys\Attachh.php almacena directamente los parámetros y valores pasados en el parámetro param sin filtrar, lo que genera un ataque de Cross Site Scripting (XSS).

25 Oct 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-25 22:15

Updated : 2025-06-10 18:46

NVD link : CVE-2024-48228

Mitre link : CVE-2024-48228

CVE.ORG link : CVE-2024-48228

JSON object : View

Products Affected

funadmin

  • funadmin
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')