Read the docs
TI-2024-30766 Aliases CVE-2024-45799

Javascript Injection in Vending Info/Buyers Info Module in FluxCP

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-79.

Summary

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a result all logged in to fluxcp users can have their session info stolen. This issue has been addressed in release version 1.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00283 20th percentileScored 2026-11-07
Fix Fixed FluxCP (rathena): 1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rathenaFluxCPbefore 1.31.3Patch availableCNA
  • FluxCP Vendorrathena Affected before 1.3 Fixed in 1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rathena:fluxcp:*:*:*:*:*:*:*:*before 1.3.0Vulnerablerathena
  • cpe:2.3:a:rathena:fluxcp:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·rathena

Remediation

  • Fix · CNA FluxCP (rathena) Fixed in 1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45799

References

Advisory 1

  • TI-2022-04042 rAthena FluxCP Service Desk Image URL view.php cross site scripting CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences