PT-2022-11455 · Unknown · Sourcecodester Student Quarterly Grading System

Oretnom23 · Published 2022-01-24 · Updated 2022-01-28 · CVE-2021-41658

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Student Quarterly Grading System (affected versions not specified)

Description The issue allows attackers to execute arbitrary code via the fullname and username parameters to the "users page" API endpoint. This enables the execution of arbitrary code, potentially leading to security breaches.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41658

Affected Products

Sourcecodester Student Quarterly Grading System

References · 4

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-15-092121 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41658 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41658 · Vendor Advisory
• https://t.me/cibsecurity/36141 · Telegram Post