CVE-2024-33724 identifies a Cross Site Scripting (CWE-79) vulnerability in SOPlanning 1.52.00. The issue arises from insufficient input sanitization of the groupe_id parameter in the process/groupe_save.php endpoint, enabling attackers to inject and execute arbitrary scripts in users' browsers. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with attack vector network, low attack complexity, no privileges required, and requires user interaction. Confidentiality and integrity impacts are low, with no availability impact. No patch or official remediation level has been published, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser session, potentially leading to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. The vulnerability requires user interaction and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs related to the groupe_id parameter. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation.