CVE-2024-50658 describes a Server-Side Template Injection vulnerability in AdPortal 3.0.39. The flaw is present in the updateuserinfo.html file, specifically in the handling of the shippingAsBilling and firstname parameters. This allows an unauthenticated remote attacker to execute arbitrary code on the server, leading to full compromise. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected server without any privileges or user interaction. This can lead to complete system compromise, data theft, service disruption, and further attacks within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block exploitation attempts targeting the shippingAsBilling and firstname parameters.