### [CVE-2024-52875](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52875)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.

### POC

#### Reference
- https://karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875

#### Github
- https://github.com/Ostorlab/KEV
- https://github.com/tylzars/awesome-vrre-writeups
- https://github.com/zhanpengliu-tencent/medium-cve