PT-2024-39426 · Sourcecodester · Sourcecodester Profile Registration Without Reload Refresh

Jadu101 · Published 2024-09-22 · Updated 2024-09-27 · CVE-2024-9092

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Profile Registration without Reload Refresh version 1.0

Description A problem was found in the Registration Form component of the file add.php, which can lead to cross site scripting when the full name argument is manipulated. This issue can be exploited remotely, and the exploit has been disclosed to the public. Other parameters might also be affected.

Recommendations For version 1.0, consider disabling the Registration Form component in the file add.php until a patch is available. As a temporary workaround, restrict the use of the full name argument to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9092

Affected Products

Sourcecodester Profile Registration Without Reload Refresh

References · 11

• 🔥 https://github.com/jadu101/CVE/blob/main/SourceCodester_Profile_Registration_add_php_XSS.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-9092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9092 · Security Note
• https://vuldb.com/?id.278270 · Note
• https://twitter.com/CVEnew/status/1838022912361758932 · Twitter Post
• https://vuldb.com/?submit.412159 · Note
• https://vuldb.com/?ctiid.278270 · Note
• https://sourcecodester.com · Note
• https://t.me/cvedetector/6167 · Telegram Post
• https://t.me/cvenotify/95614 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1838095929934565629 · Twitter Post