PT-2021-17865 · Unknown · Teachers Record Management System

Nhattruong.Blog · Published 2021-07-01 · Updated 2023-11-14 · CVE-2021-28424

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Teachers Record Management System version 1.0

Description: A stored cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the email parameter in the "adminprofile.php" endpoint. This could potentially lead to malicious actions being executed on the system.

Recommendations: For Teachers Record Management System version 1.0, consider restricting access to the adminprofile.php endpoint until a fix is available, and avoid using the email parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-28424

Affected Products

Teachers Record Management System

References · 7

• 🔥 https://exploit-db.com/exploits/50019 · Exploit
• 🔥 https://packetstormsecurity.com/files/163171/Teachers-Record-Management-System-1.0-Cross-Site-Scripting.html · Exploit
• 🔥 https://nhattruong.blog/2021/05/22/cve-2021-28424-teachers-record-management-system-1-0-email-stored-cross-site-scripting-xss-vulnerability-authenticated · Exploit
• https://osv.dev/vulnerability/CVE-2021-28424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28424 · Security Note
• https://t.me/cibsecurity/25865 · Telegram Post
• https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql · Note