High severity · published Apr 25, 2024
CVE-2024-31609
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bosscms · Bosscms
3.10.0 · source: NVD
SS
Simple School Management System · Code-projects
1.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-31609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-31609
Exploit
https://github.com/ss122-0ss/BOSSCMS/blob/main/readme.md
More from Bosscms
9.8
CVE-2022-28606
An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd
7.8
CVE-2024-22938
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component
6.5
CVE-2022-44937
Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module
5.4
CVE-2024-31613
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."