CVE-2024-2497 | RaspAP raspap-webgui 3.0.9 HTTP POST Request includes/provider.php country code injection

A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.php of the component HTTP POST Request Handler. The manipulation of the argument country leads to code injection.

The identification of this vulnerability is CVE-2024-2497. The attack may be initiated remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.