mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-28 18:48:49 +00:00
20 lines
1.1 KiB
Markdown
20 lines
1.1 KiB
Markdown
|
### [CVE-2024-52875](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52875)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
- https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/Ostorlab/KEV
|
||
|
|
- https://github.com/tylzars/awesome-vrre-writeups
|
||
|
|
- https://github.com/zhanpengliu-tencent/medium-cve
|
||
|
|
|