PT-2024-20289 · Unknown · Sourcecodester Math Game With Leaderboard

Buraksevben · Published 2024-01-29 · Updated 2024-02-03 · CVE-2024-24136

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Math Game with Leaderboard version 1.0

Description The issue concerns a Cross-Site Scripting (XSS) attack vulnerability. Specifically, the 'Your Name' field in the Submit Score section is affected. This type of attack occurs when an application includes user input in its output without proper validation, allowing an attacker to inject malicious scripts into the application.

Recommendations For version 1.0, consider validating and sanitizing user input in the 'Your Name' field to prevent XSS attacks. As a temporary workaround, restrict user input to only allow expected characters and formats.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24136

Affected Products

Sourcecodester Math Game With Leaderboard

References · 5

• 🔥 https://github.com/BurakSevben/2024_Math_Game_XSS · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24136 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24136 · Vendor Advisory
• https://twitter.com/RedPacketSec/status/1753720806218093007 · Twitter Post
• https://t.me/cvenotify/69860 · Telegram Post