PT-2023-16954 · Sourcecodester · Sourcecodester Online Student Management System

Ssl_Seven_Security Lab_Wangzhiqiang_Xiaozilong · Published 2023-03-14 · Updated 2024-05-17 · CVE-2023-1397

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online Student Management System version 1.0

Description A vulnerability has been found in the SourceCodester Online Student Management System. The issue is related to an unknown function of the file profile.php, where the manipulation of the adminname argument leads to cross-site scripting. This can be exploited remotely.

Recommendations For version 1.0, consider disabling the adminname argument in the profile.php file until a patch is available. Restrict access to the profile.php file to minimize the risk of exploitation. Avoid using the adminname argument in the affected function until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1397

Affected Products

Sourcecodester Online Student Management System

References · 7

• 🔥 https://github.com/E1CHO/cve_hub/blob/main/Online%20student%20management%20system%20pdf/Online%20student%20management%20system%20xss%20vlun%203.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2023-1397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1397 · Security Note
• https://t.me/cvenotify/46110 · Telegram Post
• https://t.me/cibsecurity/59969 · Telegram Post
• https://vuldb.com/?id.222984 · Note
• https://vuldb.com/?ctiid.222984 · Note