The vulnerability CVE-2024-50534 affects techdabang's World Prayer Time application (versions up to 2.0) and involves Cross-Site Request Forgery (CSRF) that enables Stored Cross-Site Scripting (XSS). An attacker can exploit this flaw by tricking an authenticated user into submitting a crafted request, which results in malicious script storage and potential execution within the application context. The CVSS 3.1 base score of 7.1 reflects network exploitability, low complexity, no required privileges, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability at a low level each.

Successful exploitation of this vulnerability could allow attackers to execute stored malicious scripts within the application, potentially leading to session hijacking, data manipulation, or denial of service. The combined CSRF and Stored XSS nature means attackers can induce authenticated users to perform unwanted actions and inject persistent scripts affecting other users. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users and administrators should be cautious with untrusted links and consider implementing additional CSRF protections such as anti-CSRF tokens or same-site cookie attributes if possible within the application environment.