CVE-2024-5409

Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190

Description: The issue allows for an XSS attack via the tamper parameter in the "/admin/lib/phpthumb/phpthumb.php" API endpoint. An attacker could create a malicious URL and send it to a victim to obtain their session details.

Recommendations: For RhinOS versions 3.0-1190, avoid using the tamper parameter in the "/admin/lib/phpthumb/phpthumb.php" API endpoint until a fix is available. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.