CVE-2024-48622: 
DomainMOD vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability has been identified in DomainMOD versions below 4.12.0. The vulnerability, tracked as CVE-2024-48622, was discovered and disclosed on October 15, 2024. The issue affects the admin/domain-fields/edit.php file, specifically through the cdfid parameter (NVD, GitHub Issue).

The vulnerability exists due to improper input validation in the admin/domain-fields/edit.php file. The cdfid parameter in GET requests is directly concatenated to $_SESSION['s_message_danger'] without proper validation and is subsequently output to the frontend, enabling cross-site scripting attacks. The vulnerability has been assigned CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.6 (Medium) (NVD).

If exploited, this vulnerability allows remote attackers to inject malicious JavaScript code via the cdfid parameter in the admin/domain-fields/edit.php page. This could potentially lead to cookie theft, session hijacking, or other client-side attacks (GitHub Issue).

The vulnerability can be exploited by sending a crafted GET request to the affected endpoint. A proof of concept exists demonstrating the exploitation by using a specially crafted URL with the cdfid parameter to trigger an XSS payload that executes JavaScript code (GitHub Issue).

Users should upgrade to DomainMOD version 4.12.0 or later, which contains fixes for this vulnerability (NVD).