CVE-2024-45799— Javascript Injection in Vending Info/Buyers Info Module in FluxCP
Quick assessment
Affected
rathena FluxCP
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FluxCP是rAthena开源的一个基于 web 的控制面板。用于用 PHP 编写的 rAntha 服务器。 FluxCP 1.3之前版本存在安全漏洞，该漏洞源于venders/buyers列表页面和商店名称未经过滤，允许执行任意javascript代码，这可以通过访问商店页面在用户的浏览器上实现，可能导致所有登录用户的会话信息被窃取。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-45799
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Javascript Injection in Vending Info/Buyers Info Module in FluxCP
Source: CVE Program / CVE List V5
Vulnerability Description
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
FluxCP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FluxCP是rAthena开源的一个基于 web 的控制面板。用于用 PHP 编写的 rAntha 服务器。 FluxCP 1.3之前版本存在安全漏洞，该漏洞源于venders/buyers列表页面和商店名称未经过滤，允许执行任意javascript代码，这可以通过访问商店页面在用户的浏览器上实现，可能导致所有登录用户的会话信息被窃取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-45799
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 8598 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2024-45799
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: rathena
-
CVE-2025-62797
CSRF in FluxCP account endpoints allows account takeover / s -
CVE-2025-62170
rAthena map-server use-after-free vulnerability in RODEX -
CVE-2025-58750
rAthena missing bound check in chclif_parse_moveCharSlot -
CVE-2025-58448
rAthena has SQL Injection in PartyBooking component via `Wor -
CVE-2025-58447
rAthena has heap-based buffer overflow in login server
Same weakness: CWE-79
-
CVE-2026-8630
justhtml before 1.12.0 Mutation XSS via Raw Text Elements -
CVE-2026-8445
justhtml before 1.12.0 Sanitizer Bypass via Markdown -
CVE-2026-77088
justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code- -
CVE-2026-74793
justhtml before 3.11.0 XSS via selectedcontent projection -
CVE-2026-6827
justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnera
V. Comments for CVE-2024-45799
No comments yet