CVE-2024-24398: 
JavaScript vulnerability analysis and mitigation

Stimulsoft Dashboards.PHP, versions prior to 2024.1.2, contains an arbitrary file write vulnerability. The vulnerability was discovered on January 10, 2024, and was assigned CVE-2024-24398. The issue was fixed in version 2024.1.3, released on January 19, 2024. This vulnerability affects the Dashboards Application component of the software (CVE Writeup).

The vulnerability exists in the fileName parameter functionality when saving reports on the server. The flaw allows writing files to any location accessible by the webserver's user by manipulating the file path (e.g., using '../' in the path). The vulnerability has been assigned a CVSS v3.1 score of 8.6, indicating high severity with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (CVE Writeup).

The vulnerability allows an unauthenticated attacker to write files to arbitrary locations on the server that are accessible to the webserver's user. This could lead to system compromise through the placement of malicious files, potential information disclosure, and system integrity issues (CVE Writeup).

The vulnerability has been fixed in Stimulsoft Dashboards.PHP version 2024.1.3. Users are advised to upgrade to this version or later to address the security issue (CVE Writeup).