PT-2021-23645 · Unknown · Sourcecodester Engineers Online Portal

Alon Leviev · Published 2021-11-05 · Updated 2021-11-17 · CVE-2021-42664

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal (affected versions not specified)

Description A Stored Cross Site Scripting (XSS) issue exists in the Sourcecodester Engineers Online Portal in PHP. This is due to the quiz title and quiz description parameters in the "add quiz.php" endpoint. An attacker can leverage this issue to run javascript commands on the web server surfer's behalf, potentially leading to cookie stealing.

Recommendations As a temporary workaround, consider restricting access to the "add quiz.php" endpoint until a patch is available. Avoid using the quiz title and quiz description parameters in the affected endpoint until the issue is resolved. Restrict the execution of javascript commands on the web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42664

Affected Products

Sourcecodester Engineers Online Portal

References · 9

• 🔥 https://github.com/TheHackingRabbi/CVE-2021-42664 · Exploit
• 🔥 http://packetstormsecurity.com/files/164618/Engineers-Online-Portal-1.0-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/50451 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42664 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42664 · Vendor Advisory
• https://t.me/cibsecurity/31878 · Telegram Post
• https://t.me/cvenotify/23198 · Telegram Post
• https://sourcecodester.com/php/13115/engineers-online-portal-php.html · Note
• https://t.me/cvenotify/23165 · Telegram Post