PT-2021-18605 · Unknown · Web-School Erp

0Xrayan · Published 2021-04-08 · Updated 2021-04-13 · CVE-2021-30111

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0

Description A stored XSS issue exists via the Add Events feature in the event name and description fields, allowing an attack to inject JavaScript code that will be stored and executed when visitors view the events.

Recommendations For Web-School ERP version 5.0, consider disabling the Add Events feature until a patch is available to prevent the injection of malicious JavaScript code. Restrict access to the event name and description fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-30111

Affected Products

Web-School Erp

References · 5

• 🔥 https://github.com/0xrayan/CVEs/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2021-30111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30111 · Security Note
• https://web-school.in/try-demo · Note
• http://web-school.in · Note