Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2024-8144: ClassCMS 4.8 admin logo page allows remote script injection
CVE-2024-8144 · published 2 years ago
Summary
The admin section of ClassCMS version 4.8 that handles logo uploads can be tricked into running malicious code in a visitor’s browser. An attacker could send a specially crafted request and cause the page to execute unwanted scripts, potentially stealing data or altering the displayed content. Apply the vendor’s security update or disable the logo handling feature until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| classcms | classcms |
4.8 cpe:2.3:a:classcms:classcms:4.8:*:*:*:*:*:*:* |
Original advisory text
ClassCMS Logo admin cross site scripting
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8144.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-8144 Vendor Advisory
- https://vuldb.com/?id.275725 Vendor Advisory
- https://vuldb.com/?submit.397217 Vendor Advisory
- https://vuldb.com/?ctiid.275725 Third Party Advisory
- https://github.com/acmglz/bug2_report/blob/main/classcms_xss.md Exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published25 Aug 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta