PT-2024-29320 · Unknown · Kashipara Responsive School Management System

Published 2024-08-07 · Updated 2024-08-08 · CVE-2024-41242

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Responsive School Management System version 3.2.0

Description A Reflected Cross Site Scripting (XSS) issue was discovered in the /smsa/student login.php endpoint, allowing remote attackers to execute arbitrary code via the error parameter. This enables attackers to inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For Kashipara Responsive School Management System version 3.2.0, consider disabling the error parameter in the /smsa/student login.php endpoint until a patch is available to prevent exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41242

Affected Products

Kashipara Responsive School Management System

References · 5

• 🔥 https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Responsive%20School%20Management%20System%20v3.2.0/Reflected%20XSS%20-%20Student.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-41242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41242 · Security Note
• https://kashipara.com/project/php/12362/responsive-school-management-system-php-project-source-code · Note
• https://t.me/cvedetector/2731 · Telegram Post