CVE-2024-24807: 
PHP vulnerability analysis and mitigation

A HTML injection vulnerability (CVE-2024-24807) was discovered in Sulu versions >=2.0.0. The vulnerability affects the tag name autocomplete functionality, where HTML input in tag names can be executed when listed in the autocomplete form. This security issue specifically impacts admin users, who are both the potential victims and the only users capable of creating tags (Sulu Advisory).

The vulnerability is classified as CWE-80 and has been assigned a Low severity rating. The issue occurs when HTML is injected into tag names, which is then executed when the tag name appears in the autocomplete suggestion list. The vulnerability is limited to the admin interface and requires admin privileges to exploit (Sulu Advisory).

The impact of this vulnerability is limited to admin users of Sulu installations. When exploited, it allows for HTML injection through the tag autocomplete feature, potentially leading to unwanted HTML execution in the admin interface (Sulu Advisory).

The vulnerability has been patched in Sulu versions 2.4.16 and 2.5.12. Users are advised to upgrade to these patched versions to resolve the security issue. No specific workarounds have been provided for users who cannot immediately upgrade (Sulu Advisory).