PT-2020-17113 · Egavilanmedia · Egavilanmedia User Registration/Login System With Admin Panel

Hemant Patidar + 1 · Published 2020-12-30 · Updated 2021-01-04 · CVE-2020-29230

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EGavilanMedia User Registration and Login System With Admin Panel version 1.0

Description The issue affects the Admin Panel, specifically the Manage User tab, where an attacker can inject a cross-site scripting (XSS) payload using the Full Name of the user. This allows the attacker to steal cookies when the admin visits the manage user section, based on the crafted payload.

Recommendations For EGavilanMedia User Registration and Login System With Admin Panel version 1.0, consider restricting the input for the Full Name field in the User Registration section to prevent XSS payload injection, and avoid using the Manage User tab until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29230

Affected Products

Egavilanmedia User Registration/Login System With Admin Panel

References · 5

• 🔥 https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-29230.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-29230 · Vendor Advisory
• http://egavilanmedia.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29230 · Security Note
• https://t.me/cvenotify/7975 · Telegram Post