PT-2023-25532 · Sourcecodester · Sourcecodester Student Study Center Desk Management System

Ujjwal Saran · Publicado 2023-08-23 · Atualizado 2024-09-07 · CVE-2023-36317

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions sourcecodester Student Study Center Desk Management System version 1.0

Description The issue allows attackers to run arbitrary code via a crafted GET request to the web application URL. This is a Cross Site Scripting (XSS) vulnerability, which means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take control of the user's session.

Recommendations For sourcecodester Student Study Center Desk Management System version 1.0, consider implementing input validation and sanitization for all GET requests to prevent malicious code injection. As a temporary workaround, restrict access to sensitive areas of the web application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-36317

Produtos afetados

Sourcecodester Student Study Center Desk Management System

Referências · 7

• 🔥 https://github.com/oye-ujjwal/CVE/blob/main/CVE-2023-36317 · Exploit
• https://osv.dev/vulnerability/CVE-2023-36317 · Aviso do Fabricante
• https://sourcecodester.com/php/16298/student-study-center-desk-management-system-using-php-oop-and-mysql-db-free-source-code · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36317 · Nota de Segurança
• https://t.me/cibsecurity/69102 · Publicação no Telegram
• https://sourcecodester.com · Nota
• https://t.me/cvenotify/57152 · Publicação no Telegram