PT-2021-11744 · Unknown · Employee Performance Evaluation System

Published 2021-01-20 · Updated 2021-01-27 · CVE-2020-35272

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Employee Performance Evaluation System in PHP/MySQLi with Source Code version 1.0

Description: The issue concerns cross-site scripting (XSS) in the Admin Portal, specifically in the Task and Description fields. This allows for potential malicious script injection, which could lead to unauthorized actions on the system.

Recommendations: For Employee Performance Evaluation System in PHP/MySQLi with Source Code version 1.0, consider validating and sanitizing user input in the Task and Description fields to prevent XSS attacks. As a temporary workaround, restrict access to the Admin Portal to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-35272

Affected Products

Employee Performance Evaluation System

References · 4

• 🔥 https://exploit-db.com/exploits/49215 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35272 · Security Note
• https://t.me/cibsecurity/22339 · Telegram Post