CVE-2024-49705

Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accepted as the server returns an error message. Since this parameter is sent as part of a session cookie, the issue persists until the session expires or the user deletes cookies manually. Similar effect might be achieved when a user tries to change platform language to an unimplemented one. This vulnerability has been patched in version 79.0

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/04/CVE-2024-10087
https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html

Configurations

No configuration.

History

15 Apr 2025, 18:39

Type	Values Removed	Values Added
Summary		(es) Internet Starter, uno de los módulos del sistema SoftCOM iKSORIS, es vulnerable a ataques de denegación de servicio (DoS) del lado del cliente. Un atacante podría engañar a un usuario para que use una URL con el parámetro ad configurado con un valor no controlado. Las solicitudes posteriores no serán aceptadas, ya que el servidor devuelve un mensaje de error. Dado que este parámetro se envía como parte de una cookie de sesión, el problema persiste hasta que la sesión expira o el usuario elimina las cookies manualmente. Un efecto similar podría ocurrir si un usuario intenta cambiar el idioma de la plataforma a uno no implementado. Esta vulnerabilidad ha sido corregida en la versión 79.0.

14 Apr 2025, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-14 12:15

Updated : 2025-04-15 18:39

NVD link : CVE-2024-49705

Mitre link : CVE-2024-49705

CVE.ORG link : CVE-2024-49705

JSON object : View

Products Affected

No product.

CWE

CWE-248

Uncaught Exception

{"id": "CVE-2024-49705", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-14T12:15:15.120", "references": [{"url": "https://cert.pl/en/posts/2025/04/CVE-2024-10087", "source": "cvd@cert.pl"}, {"url": "https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accepted as the server returns an error message. Since this parameter is sent as part of a session cookie, the issue persists until the session expires or the user deletes cookies manually.\u00a0\nSimilar effect might be achieved when\u00a0a user tries to change platform language to an unimplemented one.\nThis vulnerability has been patched in version 79.0"}, {"lang": "es", "value": "Internet Starter, uno de los m\u00f3dulos del sistema SoftCOM iKSORIS, es vulnerable a ataques de denegaci\u00f3n de servicio (DoS) del lado del cliente. Un atacante podr\u00eda enga\u00f1ar a un usuario para que use una URL con el par\u00e1metro ad configurado con un valor no controlado. Las solicitudes posteriores no ser\u00e1n aceptadas, ya que el servidor devuelve un mensaje de error. Dado que este par\u00e1metro se env\u00eda como parte de una cookie de sesi\u00f3n, el problema persiste hasta que la sesi\u00f3n expira o el usuario elimina las cookies manualmente. Un efecto similar podr\u00eda ocurrir si un usuario intenta cambiar el idioma de la plataforma a uno no implementado. Esta vulnerabilidad ha sido corregida en la versi\u00f3n 79.0."}], "lastModified": "2025-04-15T18:39:27.967", "sourceIdentifier": "cvd@cert.pl"}