PT-2022-13777 · Unknown · School Club Application System

Mrempy · Published 2022-04-09 · Updated 2022-04-15 · CVE-2022-1288

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions School Club Application System version 1.0

Description A problematic issue has been found in the School Club Application System, affecting access to the "/scas/admin/" endpoint. The manipulation of the page parameter with a specific input leads to a reflected cross-site scripting issue. This can be initiated remotely without requiring any form of authentication. The issue has been publicly disclosed.

Recommendations For School Club Application System version 1.0, consider restricting access to the "/scas/admin/" endpoint until a fix is available. As a temporary workaround, avoid using the page parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1288

Affected Products

School Club Application System

References · 4

• https://osv.dev/vulnerability/CVE-2022-1288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1288 · Security Note
• https://t.me/cibsecurity/40433 · Telegram Post
• https://vuldb.com/?id.196751 · Note