PT-2024-25761 · Unknown · Qdocs Smart School

Grumpz + 1 · Published 2024-05-20 · Updated 2025-11-14 · CVE-2024-34240

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QDOCS Smart School version 7.0.0

Description The issue is related to Cross Site Scripting (XSS), which results in arbitrary code execution in admin functions, specifically when adding or updating records. This could potentially allow an attacker to execute malicious code on the system.

Recommendations For QDOCS Smart School version 7.0.0, consider disabling admin functions related to adding or updating records until a patch is available. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-34240

Affected Products

Qdocs Smart School

References · 9

• 🔥 https://grumpz.net/cve-2024-34240-latest-stored-xss-0day-vulnerability-unveiled · Exploit
• https://osv.dev/vulnerability/CVE-2024-34240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34240 · Security Note
• https://twitter.com/grumpzsux/status/1792785672237179304 · Twitter Post
• https://twitter.com/CVEnew/status/1793284039983743401 · Twitter Post
• https://t.me/cvenotify/91318 · Telegram Post
• https://t.me/cvenotify/80675 · Telegram Post
• https://t.me/cveNotify/142812 · Telegram Post
• https://t.me/cvenotify/80602 · Telegram Post