CVE-2024-5737
Published: 28 June 2024
Summary
CVE-2024-5737 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Admiror-Design-Studio Admirorframes. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability affects the afGdStream.php script in the AdmirorFrames Joomla! extension prior to version 5.0. Because the script does not set a Content-Type header, responses default to text/html, allowing an attacker to embed HTML tags directly inside image data that is later rendered by a browser as executable markup. The issue is tracked as CWE-79 with a CVSS 4.0 score of 6.3.
An unauthenticated attacker can supply a malicious image file that is processed by the affected script. When the resulting page is viewed, the embedded HTML executes in the context of the victim’s browser, enabling limited integrity and availability impacts without requiring user interaction or privileges.
Public references include technical write-ups from cert.pl and multiple GitHub repositories containing further analysis and proof-of-concept material. The EPSS score has remained flat at 0.1611 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46898
- 🇵🇱 CERT-PL: cert.pl
- 🇵🇱 CERT-PL: cert.pl
Vulnerability details
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects…
more
AdmirorFrames: before 5.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The XSS vulnerability (CWE-79) in afGdStream.php allows attackers to inject HTML/JavaScript into image data rendered as text/html, enabling exploitation of a public-facing web application (T1190) and JavaScript execution in victim browsers (T1059.007).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.