PT-2024-38694 · Sourcecodester · Sourcecodester Simple Forum Website

Urayaha · Published 2024-08-19 · Updated 2024-08-21 · CVE-2024-7929

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Forum Website version 1.0

Description A problematic vulnerability was found in the Signup Page component, specifically affecting the /registration.php file. The manipulation of the username argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

Recommendations For version 1.0, consider disabling the Signup Page component or restricting access to the /registration.php file until a patch is available. As a temporary workaround, avoid using the username argument in the affected Signup Page component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7929

Affected Products

Sourcecodester Simple Forum Website

References · 10

• 🔥 https://github.com/ulayaha/ulayaha.github.io/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7929 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7929 · Vendor Advisory
• https://vuldb.com/?id.275115 · Note
• https://twitter.com/VulmonFeeds/status/1825698263627956552 · Twitter Post
• https://vuldb.com/?ctiid.275115 · Note
• https://t.me/cvenotify/91203 · Telegram Post
• https://vuldb.com/?submit.392325 · Note
• https://t.me/cvedetector/3568 · Telegram Post
• https://twitter.com/CVEnew/status/1825648760149393908 · Twitter Post