PT-2021-22848 · Sourcecodester · Sourcecodester Tailor Management

Published 2021-11-08 · Updated 2021-11-13 · CVE-2021-40260

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management version 1.0

Description Multiple Cross Site Scripting (XSS) vulnerabilities exist in the software. The vulnerabilities are found in the eid parameter in partedit.php and customeredit.php, the id parameter in editmeasurement.php and addpayment.php, and the error parameter in index.php.

Recommendations For version 1.0, consider disabling access to the vulnerable parameters eid, id, and error in the respective files until a patch is available. Restrict access to the affected API endpoints, specifically partedit.php, customeredit.php, editmeasurement.php, addpayment.php, and index.php, to minimize the risk of exploitation. Avoid using the parameters eid, id, and error in the affected files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-40260

Affected Products

Sourcecodester Tailor Management

References · 4

• 🔥 https://sisl.lab.uic.edu/projects/chess/tailor-management · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-40260 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40260 · Vendor Advisory
• https://t.me/cibsecurity/32022 · Telegram Post