PT-2021-18607 · Unknown · Web-School Erp

0Xrayan · Published 2021-04-08 · Updated 2021-04-13 · CVE-2021-30113

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0

Description A blind XSS issue exists, allowing an attacker to inject JavaScript code into the event name and description fields via the Add Events feature. This code is stored on the page and executed when a visitor views the event, potentially sending the victim's information to the attacker's website.

Recommendations For Web-School ERP version 5.0, consider disabling the Add Events feature or restricting access to it until a fix is available. As a temporary workaround, restrict the ability to inject JavaScript code into the event name and description fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-30113

Affected Products

Web-School Erp

References · 5

• 🔥 https://github.com/0xrayan/CVEs/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2021-30113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30113 · Security Note
• https://web-school.in/try-demo · Note
• http://web-school.in · Note