Every CVE Search/ Get API key

CVE-2024-56361

Stored Cross-Site Scripting (XSS) in lgsl v7.0

5.3 MediumFix available

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.46%Up 0.4 points since Dec 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Stored Cross-Site Scripting (XSS) in lgsl v7.0

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Record
CVE-2024-56361
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-3623 5.3

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Record
EUVD-2024-3623
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-xx95-62h6-h7v3 No score

lgsl Stored Cross-Site Scripting vulnerability

Summary

A stored cross-site scripting (XSS) vulnerability was identified in lgsl. The issue arises from improper sanitation of user input. Everyone who accesses this page will be affected by this attack.

Details

The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php

Affected Code:

      foreach ($server['e'] as $field => $value) {
        $value = preg_replace('/((https*:\/\/|https*:\/\/www\.|www\.)[\w\d\.\-\/=$?​]*)/i', "<a href='$1' target='_blank'>$1</a>", html_entity_decode($value));
        $output .= "
        <tr><td> {$field} </td><td> {$value} </td></tr>";
      }

PoC

  1. Create a game server with type eco and set the target host and port accordingly to your ttack server. I have crafted this json payload that is being parsed according to the schema and being served on /info

  2. Serve the following JSON payload at /info on your handler

{
  "Animals": "1",
  "EconomyDesc": "<img src=x onerror=prompt(1)>"
}
  1. Access the corresponding server info page at /s?=. Upon refreshing & crawling our server, it should execute our javascript.
Record
GHSA-xx95-62h6-h7v3
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Record
CVE-2024-56361
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSV 5.3

Stored Cross-Site Scripting (XSS) in lgsl v7.0

LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.

Record
CVE-2024-56361
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-xx95-62h6-h7v3 No score

lgsl Stored Cross-Site Scripting vulnerability

Summary

A stored cross-site scripting (XSS) vulnerability was identified in lgsl. The issue arises from improper sanitation of user input. Everyone who accesses this page will be affected by this attack.

Details

The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php

Affected Code:

      foreach ($server['e'] as $field => $value) {
        $value = preg_replace('/((https*:\/\/|https*:\/\/www\.|www\.)[\w\d\.\-\/=$?​]*)/i', "<a href='$1' target='_blank'>$1</a>", html_entity_decode($value));
        $output .= "
        <tr><td> {$field} </td><td> {$value} </td></tr>";
      }

PoC

  1. Create a game server with type eco and set the target host and port accordingly to your ttack server. I have crafted this json payload that is being parsed according to the schema and being served on /info

  2. Serve the following JSON payload at /info on your handler

{
  "Animals": "1",
  "EconomyDesc": "<img src=x onerror=prompt(1)>"
}
  1. Access the corresponding server info page at /s?=. Upon refreshing & crawling our server, it should execute our javascript.
Record
GHSA-xx95-62h6-h7v3
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tltneon/lgsl
Packagist
 before 7.0.0
7.0.0
tltneon/lgsl
Packagist
 before 7.0.0, plus listed versions
v5.10.0v5.10.1v5.10.2v5.10.3v6.0.0
Show 5 moreShow less
v6.0.1v6.1.0v6.1.1v6.2.0v6.2.1
7.0.0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56361 is a medium vulnerability (CVSS 5.3) in Tltneon Lgsl, published December 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in tltneon/lgsl 7.0.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open