PT-2024-28406 · Skycaiji · Skycaiji
CVE-2024-39242
·
Published
2024-06-26
·
Updated
2024-08-19
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
skycaiji version 2.8
Description
A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload using
eval(String.fromCharCode()). This enables the execution of malicious code on the victim's browser.Recommendations
For skycaiji version 2.8, consider disabling the use of
eval(String.fromCharCode()) until a patch is available to prevent the execution of malicious scripts. Restrict access to sensitive areas of the application to minimize the risk of exploitation.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Skycaiji