Cyber Resilience

CVE-2024-48589

Medium

Published: 06 February 2025

Published
06 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS Score 0.0754 92.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-48589 is a medium-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2024-48589 is a cross-site scripting vulnerability, categorized under CWE-79, that affects Gilnei Moraes phpABook version 0.9. The flaw resides in the rol parameter of index.php and carries a CVSS 3.1 base score of 6.3.

A remote attacker can exploit the issue over the network without authentication, though user interaction is required. Successful exploitation permits arbitrary code execution that yields limited impacts on confidentiality, integrity, and availability.

The single reference is a GitHub repository that does not contain vendor advisories or patch information. The associated EPSS score remains low, with a current value of 0.0754 and a peak of 0.0871, indicating no material rise that would signal emerging exploitation interest.

EU & UK References

Vulnerability details

Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter in index.php

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

XSS in public-facing web app directly enables browser-based JS execution via crafted parameter input.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Validates inputs to the 'rol' parameter in index.php, preventing injection of malicious XSS payloads that enable arbitrary code execution.

SI-15 Information Output Filtering good match
prevent

Filters and encodes information output derived from the 'rol' parameter, blocking XSS script execution in the victim's browser context.

SI-2 Flaw Remediation good match
preventrecover

Mandates timely identification, reporting, and remediation of the specific XSS flaw (CVE-2024-48589) in phpABook v.0.9 via patches or fixes.

References