CVE-2024-52305

CVE-2024-52305 is a medium-severity vulnerability affecting UnoPim, an open-source Product Information Management system. It allows an authenticated attacker to create a new admin account and upload a malicious SVG file as a profile image. When this image is accessed, an embedded script executes, potentially leading to session cookie theft. The vulnerability has a CVSS score of 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), indicating it requires high privileges and user interaction, but can result in low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is fixed in UnoPim version 0.1.5.