Vulnerability · Published Jan 10, 2025 · Assigned by CERT-PL

CVE-2024-6880CSRF in MegaBIP

Medium 6.9

In plain English

A medium-severity security flaw in MegaBIP from Jan Syski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms. Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks. This issue affects MegaBIP software versions below 5.15

Affected products (as reported)

Vendor	Product	Versions
Jan Syski	MegaBIP	0 – before 5.15

Weakness: CWE-538 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2024/09/CVE-2024-6680 third-party-advisory
https://megabip.pl/ product
https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej government-resource