medium6.1Public exploit code
CVE-2024-50861
The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GestioIP 3.5.7 - Stored Cross-Site Scripting (Stored XSS)2025-04-14 · remote · multiple
Impact
The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gestioip | Gestioip | Version 3.5.7 |