CVE-2024-50658

CVE-2024-50658 is a Server-Side Template Injection (SSTI) vulnerability, classified under CWE-94, affecting AdPortal version 3.0.39. The issue resides in the updateuserinfo.html file, where the shippingAsBilling and firstname parameters can be manipulated to enable arbitrary code execution. It received a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.

A remote attacker requires no authentication to exploit this vulnerability over the network. Successful exploitation grants the attacker the ability to execute arbitrary code on the server, potentially leading to full compromise with high impacts on confidentiality, integrity, and availability as per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Advisories and further details are referenced at http://adportal.com, http://ipublish.com, and https://petercipolone.info/wp-content/uploads/2025/01/iPublishMedia_AdPortal3.0.39_CVEs.pdf, published on 2025-01-07.