REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website.
References
| Link | Resource |
|---|---|
| https://github.com/ShellFighter/Reports/blob/main/Vanderbilt%20REDCap%2014.7.0.md | Exploit Third Party Advisory |
| https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ | Product |
Configurations
History
30 Apr 2025, 16:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ShellFighter/Reports/blob/main/Vanderbilt%20REDCap%2014.7.0.md - Exploit, Third Party Advisory | |
| References | () https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - Product | |
| CPE | cpe:2.3:a:vanderbilt:redcap:14.7.0:*:*:*:*:*:*:* | |
| First Time |
Vanderbilt redcap
Vanderbilt |
Information
Published : 2024-09-02 05:15
Updated : 2025-04-30 16:44
NVD link : CVE-2024-45527
Mitre link : CVE-2024-45527
CVE.ORG link : CVE-2024-45527
JSON object : View
Products Affected
vanderbilt
- redcap
CWE
CWE-352
Cross-Site Request Forgery (CSRF)