CVE-2024-9007
Published: 19 September 2024
Summary
CVE-2024-9007 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jeanmarc77 123Solar. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-9007 is a cross-site scripting vulnerability in the jeanmarc77 123solar application version 1.8.4.5. It resides in an unspecified portion of the /detailed.php file, where unsanitized input supplied to the date1 parameter can be used to inject arbitrary script. The issue is remotely triggerable and was assigned CWE-79 with a CVSS 4.0 base score of 5.3.
An attacker with low-privileged access can supply a crafted date1 value that executes script in the context of other users who view the affected page. Because the exploit has already been published, the attack requires no special user interaction and can result in unauthorized actions within the victim’s session.
Public references point to a specific commit (94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f) that addresses the flaw; the project’s GitHub issues and the associated VulDB entries recommend applying this patch. The EPSS score rose from a low baseline to a peak of 0.0684 on 2025-12-11 before receding, indicating a temporary increase in exploitation interest after disclosure. No additional real-world exploitation details are reported in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49661
Vulnerability details
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely.…
more
The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in /detailed.php enables exploitation of a public-facing web application (T1190), arbitrary JavaScript execution in the victim's browser (T1059.007), and theft of web session cookies as shown in the POC (T1539).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.