CVE-2024-11492 in 115cms
Summary
by MITRE • 11/20/2024
A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability represents a critical cross site scripting flaw in 115cms version 20240807 and earlier, specifically within the administrative web interface at the path /index.php/admin/web/appurladd.html. The issue stems from inadequate input validation and sanitization of the tid parameter, which allows malicious actors to inject arbitrary JavaScript code into the application's response. This weakness enables attackers to execute malicious scripts in the context of a victim's browser session, potentially leading to unauthorized actions or data theft.
The technical implementation of this vulnerability aligns with CWE-79, which describes cross site scripting flaws that occur when an application includes untrusted data in web pages without proper validation or escaping. The flaw exists in the administrative component of 115cms where user-supplied input from the tid parameter is directly incorporated into HTML output without appropriate sanitization measures. Attackers can craft malicious payloads that exploit this weakness by submitting specially crafted values through the tid argument, which then gets reflected back to unsuspecting users who visit the affected page.
The operational impact of this vulnerability is significant as it provides remote attack capabilities without requiring authentication or prior access to the system. An attacker can leverage this flaw to perform session hijacking, steal cookies, redirect users to malicious sites, or execute arbitrary commands within the victim's browser context. The fact that this exploit has been publicly disclosed and is potentially in use means that organizations running affected versions of 115cms are immediately at risk of exploitation. The vulnerability affects the administrative web application interface, which typically contains sensitive functionality and privileged operations that could be compromised.
Security mitigations should focus on implementing proper input validation and output encoding mechanisms for all user-supplied data. Organizations should immediately upgrade to the latest version of 115cms where this vulnerability has been patched. Additionally, implementing content security policies, using parameterized queries for dynamic content generation, and conducting regular security assessments can help prevent similar vulnerabilities. The ATT&CK framework categorizes this as a web application attack vector under technique T1213, which involves accessing and manipulating application data through web interfaces. Organizations should also consider network-level protections such as web application firewalls that can detect and block malicious payloads targeting XSS vulnerabilities in their administrative interfaces.