PT-2024-38829 · Sourcecodester · Sourcecodester Task Progress Tracker

Jadu101 · Published 2024-08-24 · Updated 2024-08-29 · CVE-2024-8140

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SourceCodester Task Progress Tracker version 1.0

Description: A vulnerability was found in the file update-task.php, where the manipulation of the task name argument leads to cross-site scripting. The attack may be launched remotely. The estimated number of potentially affected devices is not specified.

Recommendations: For version 1.0, upgrade to version 1.1 to remediate this issue. As a temporary workaround, consider restricting access to the update-task.php file and the task name argument to minimize the risk of exploitation. Avoid using the task name argument in the affected functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8140

Affected Products

Sourcecodester Task Progress Tracker

References · 14

• 🔥 https://github.com/jadu101/CVE/blob/main/SourceCodester_Task_Progress_Tracker_Update_Task_XSS.md · Exploit
• 🔥 https://vuldb.com/?submit.396892 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8140 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8140 · Vendor Advisory
• https://vuldb.com/?ctiid.275720 · Note
• https://t.me/cvenotify/92064 · Telegram Post
• https://twitter.com/transilienceai/status/1829198242292092979 · Twitter Post
• https://t.me/cvedetector/4077 · Telegram Post
• https://sourcecodester.com · Note
• https://twitter.com/VulmonFeeds/status/1827596638031929505 · Twitter Post
• https://twitter.com/transilienceai/status/1829198263200698797 · Twitter Post
• https://vuldb.com/?id.275720 · Note
• https://twitter.com/transilienceai/status/1829198249430798696 · Twitter Post
• https://twitter.com/transilienceai/status/1829198256905048552 · Twitter Post