CVE-2024-6368

CVE-2024-6368 describes a Cross-Site Scripting (XSS) vulnerability in LabVantage LIMS 2017, specifically within the POST Request Handler when processing the /labvantage/rc?command=page file. An attacker can exploit this by manipulating the 'param1' argument, leading to the injection of malicious scripts. Rated with a CVSS score of 5.4 (Medium), this vulnerability is remotely exploitable with low attack complexity, requiring user interaction (UI:R). A successful exploit could result in limited confidentiality and integrity impacts (C:L, I:L), allowing for actions like session hijacking or defacement. While the exploit has been publicly disclosed, there is no evidence of active exploitation, nor are there readily available exploit modules in common frameworks like Metasploit or Nuclei. Community discussion and media coverage for this vulnerability are minimal, suggesting low current attention.