CVE-2024-24028

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-21 · updated 2026-06-17
Weakness: CWE-918

Description

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.

Affected products

Likeshop: before 2.5.7 — fixed in 2.5.7

How to fix

Upgrade to a fixed version: Likeshop 2.5.7. Check the vendor advisory for mitigations.

References

https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028
https://thanhlo.substack.com/p/khai-thac-lo-hong-cve-2024-24028

Get alerted when CVE-2024-24028 or the next vulnerability affects your stack