CVE-2024-12924: Akınsoft QR Menü Open Redirect Vulnerability

CVE-2024-12924 Overview

CVE-2024-12924 is an open redirect vulnerability affecting Akınsoft QR Menü, a QR-code based digital menu application. The flaw is classified under CWE-601 (URL Redirection to Untrusted Site). Attackers can craft URLs that redirect users from the trusted QR Menü domain to attacker-controlled sites. The issue enables forceful browsing and phishing campaigns against users who trust the originating domain. The vulnerability affects QR Menü versions from s1.05.05 before v1.05.12. Turkey's national cyber incident response center (USOM) published advisory TR-25-0202 covering this issue.

Critical Impact
Attackers can leverage the trusted QR Menü domain to redirect victims to phishing pages or malicious content, undermining user trust and enabling credential theft.

Affected Products

Akınsoft QR Menü version s1.05.05
Akınsoft QR Menü versions between s1.05.05 and v1.05.12
Akınsoft QR Menü versions prior to v1.05.12

Discovery Timeline

2025-09-01 - CVE-2024-12924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12924

Vulnerability Analysis

CVE-2024-12924 is an open redirect flaw in the Akınsoft QR Menü web application. The application accepts a user-controlled URL parameter and uses it as the target of a redirect without validating that the destination belongs to a trusted domain. Attackers craft links that begin with the legitimate QR Menü host and append a redirect parameter pointing to a hostile site.

The primary risk is phishing. Victims scan or click links they believe originate from a restaurant menu service and land on attacker-controlled infrastructure. The redirected page can impersonate the legitimate brand, harvest credentials, or deliver malicious payloads. User interaction is required because a victim must follow the crafted link.

The secondary risk is forceful browsing. Attackers use the redirect to bypass referrer-based access controls or reputation filters that trust the QR Menü domain. Email gateways, chat filters, and URL scanners may allow the initial link because it points to a legitimate host.

Root Cause

The root cause is missing validation of redirect destinations. The application forwards HTTP requests to a URL supplied in a query parameter without enforcing an allow-list of permitted hosts. Any absolute URL supplied by an attacker is accepted as a valid redirect target.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a URL pointing to a vulnerable QR Menü endpoint with a redirect parameter set to an attacker-controlled domain. The attacker distributes this URL through email, SMS, social media, or embedded QR codes. When the victim opens the link, the QR Menü server issues an HTTP redirect to the malicious destination.

No authentication is required to trigger the redirect. See the USOM Notification TR-25-0202 and the Siber Güvenlik Advisory TR-25-0202 for additional technical context.

Detection Methods for CVE-2024-12924

Indicators of Compromise

Web server access logs showing HTTP 3xx responses from QR Menü endpoints with external Location headers pointing to non-Akınsoft domains.
Query strings on QR Menü URLs containing parameters such as url=, redirect=, next=, or return= populated with absolute external URLs.
Referrer logs on unrelated domains showing inbound traffic originating from QR Menü redirect endpoints.

Detection Strategies

Inspect application logs for redirect responses whose destination host does not match the approved Akınsoft QR Menü domain list.
Deploy web application firewall (WAF) rules that flag or block requests where redirect parameters contain absolute URLs to external hosts.
Correlate email and messaging gateway telemetry for links containing the QR Menü host combined with encoded external URLs in query parameters.

Monitoring Recommendations

Enable alerting on spikes of outbound redirects from QR Menü endpoints to previously unseen destinations.
Track user-reported phishing incidents referencing QR Menü URLs and correlate with server-side redirect activity.
Monitor threat intelligence feeds for phishing kits abusing Akınsoft-branded infrastructure.

How to Mitigate CVE-2024-12924

Immediate Actions Required

Upgrade Akınsoft QR Menü to version v1.05.12 or later as the primary remediation.
Audit existing QR Menü deployments to identify all endpoints that accept redirect parameters.
Notify users and customer-facing staff about the phishing risk while patching is scheduled.

Patch Information

Akınsoft addressed the vulnerability in QR Menü v1.05.12. All installations from s1.05.05 up to but not including v1.05.12 are affected and must be upgraded. Refer to the Siber Güvenlik Advisory TR-25-0202 for vendor coordination details.

Workarounds

Implement WAF rules that reject requests where redirect parameters contain absolute URLs or non-approved hostnames.
Enforce an allow-list of permitted redirect destinations at the reverse proxy layer until the patch is applied.
Rewrite outbound redirect responses to display an interstitial warning page when the target host is external.

bash

# Example nginx rule to block absolute external URLs in redirect parameters
if ($arg_url ~* "^https?://(?!([a-z0-9-]+\.)*akinsoft\.com\.tr)") {
    return 403;
}