TI-2024-37320 Aliases CVE-2024-56361 GHSA-xx95-62h6-h7v3

Stored Cross-Site Scripting (XSS) in lgsl v7.0

MEDIUM 63CWE-79Published 2024-12-26 · Updated 2024-12-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00463 40th percentileScored 2026-11-07

Fix Fixed lgsl (tltneon): 7.0.0tltneon/lgsl (Packagist): 7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tltneon	lgsl	before 7.0.0	7.0.0	Patch available	CNA
—	tltneon/lgsl (Packagist)	before 7.0.0	7.0.0	Patch available	GHSA-xx95-62h6-h7v3

lgsl Vendortltneon Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
tltneon/lgsl (Packagist) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-xx95-62h6-h7v3

Remediation

Fix · CNA lgsl (tltneon) Fixed in 7.0.0
Fix · GHSA-xx95-62h6-h7v3 tltneon/lgsl (Packagist) Fixed in 7.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-56361
2026-10-03 Alias added: GHSA-xx95-62h6-h7v3

References

Other 3

TI-2024-37404 LGSL has a reflected XSS at /lgsl_files/lgsl_list.php CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences