CVE-2024-28190: 
PHP vulnerability analysis and mitigation

CVE-2024-28190 affects Contao, an open source content management system. The vulnerability was discovered in versions starting from 4.0.0 and prior to versions 4.13.40 and 5.3.4, where users can inject malicious code in filenames when uploading files (both in back end and front end), which is then executed in tooltips and popups in the back end (Contao Advisory, GitHub Advisory).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires network access, low attack complexity, low privileges, and user interaction (NVD).

The vulnerability allows attackers to execute malicious code through tooltips and popups in the back end of Contao when maliciously crafted filenames are processed. This could lead to unauthorized data access and potential manipulation of the admin interface (GitHub Advisory).

The vulnerability requires an attacker to have access to file upload functionality, either through the back end or front end of the Contao CMS. The attack vector is network-accessible and requires low complexity to exploit, though it does need user interaction to be successful (NVD).

The vulnerability has been patched in Contao versions 4.13.40 and 5.3.4. For users unable to update immediately, the recommended workaround is to remove upload fields from frontend forms and disable uploads for untrusted back end users (Contao Advisory).