CVE-2024-5312: PHP Server Monitor - Cross-site Scripting Vulnerability
Summary
CVE-2024-5312: PHP Server Monitor vulnerable to Cross-site Scripting. Affects phpservermon/phpservermon versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP Server Monitor is a package available on Packagist that provides a web-based monitoring tool for servers. It allows users to monitor the availability and performance of their servers, as well as receive notifications in case of any issues. The package is widely used and helps administrators ensure the smooth operation of their server infrastructure.
Vulnerability Detail
The PHP Server Monitor package, specifically version 3.2.0, is vulnerable to a Cross-site Scripting (XSS) attack. This vulnerability exists in the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page, affecting all visible parameters. An attacker can exploit this vulnerability by crafting a malicious URL and sending it to a victim. When the victim accesses the URL, the attacker can retrieve their session details. This vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.3.0
This is the first release that contains the fix.
composer require phpservermon/phpservermon:3.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Conclusion
The PHP Server Monitor package, version 3.2.0, is vulnerable to a Cross-site Scripting (XSS) attack. To mitigate this vulnerability, it is crucial to upgrade to version 3.3.0 or later. This upgrade will address the security issue and prevent potential exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpservermon/phpservermon →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of the victim's session. This can lead to various malicious activities, such as stealing sensitive information, performing actions on behalf of the victim, or redirecting them to malicious websites.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious URL and send it to a victim via email, social engineering, or other means. When the victim accesses the URL, the XSS payload is executed in their browser.
No, only version 3.2.0 of PHP Server Monitor is affected by this vulnerability. Upgrading to version 3.3.0 or later will fix the issue.
There is no specific evidence of this vulnerability being actively exploited in the wild. However, it is crucial to apply the recommended fix to prevent any potential exploitation.
You can find more information about this vulnerability, including its technical details and the fixed version, in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-rq7f-j68f-mqh3/GHSA-rq7f-j68f-mqh3.json
Related vulnerabilities
Recent vulnerabilities recorded for phpservermon/phpservermon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
