CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-9007Public Exploit

123solar - XSS (CVE-2024-9007)

PublishedSep 19, 2024
First SeenN/A
Last Seen
Reported
CVSS5.3
J
jeanmarc77123solar
web_application

Description

A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.

psychologyCrowdSec Analysis

CVE-2024-9007 is a cross-site scripting vulnerability in jeanmarc77 123solar version 1.8.4.5, specifically affecting the /detailed.php file via the date1 parameter. This flaw allows remote attackers to inject malicious scripts, potentially leading to session hijacking or unauthorized actions within the application. Public exploit details are available, making prompt patching essential to mitigate risk.

CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-9007 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the XSS vulnerability by injecting malicious scripts into the date1 parameter of /123solar/detailed.php or /123solar/indexdetailed.php, enabling arbitrary JavaScript execution in victims' browsers.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-09-19
Rule Released2025-07-24

Related Weaknesses

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References