PT-2024-26558 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Published 2024-05-28 · Updated 2024-07-03 · CVE-2024-35581

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester Laboratory Management System version 1.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Borrower Name input field.

Recommendations For Sourcecodester Laboratory Management System version 1.0, consider validating and sanitizing user input to prevent the injection of malicious scripts, and restrict access to the Borrower Name input field until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-35581

Affected Products

Sourcecodester Computer Laboratory Management System

References · 5

• 🔥 https://github.com/r04i7/CVE/blob/main/CVE-2024-35581.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-35581 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35581 · Security Note
• https://owasp.org/www-community/attacks/xss · Note
• https://portswigger.net/web-security/cross-site-scripting/stored · Note