CVE-2024-41290 PoC — FlatPress 安全漏洞

Source

https://github.com/paragbagul111/CVE-2024-41290

Associated Vulnerability

Title: FlatPress 安全漏洞 (CVE-2024-41290)
Description:FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

Description

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to > store authentication data

Readme

# CVE-2024-41290
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to  store authentication data

Additional Information:

FlatPress CMS version 1.3.1 insecurely stores authentication-related data, including usernames and hashed passwords, directly in client-side cookies. This practice exposes sensitive information to potential unauthorized access and manipulation by attackers.

Vendor of Product:

Insecure Storage of Authentication Data in Cookies

Affected Product Code Base:

FlatPress CMS version 1.3.1 - 1.3

Affected Component:

Cookie

Impact:

Usernames and hashed passwords are exposed in client-side cookies, which can be accessed or modified by unauthorized parties.

If an attacker gains access to these cookies, they can potentially impersonate users or decrypt hashed passwords offline

Discoverer:

Parag Bagul

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →