PT-2024-39851 · Craig Rodway · Classroombookings

Cream3Gg + 1 · Published 2024-10-10 · Updated 2024-10-17 · CVE-2024-9806

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craig Rodway Classroombookings versions up to 2.8.6

Description A vulnerability has been found in the component Room Page, affecting unknown code of the file /rooms/fields. The manipulation of the argument Name leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Craig Rodway Classroombookings versions up to 2.8.6, upgrade to version 2.8.7 to address this issue. As a temporary workaround, consider restricting access to the Name field in the Room Page until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9806

Affected Products

Classroombookings

References · 10

• 🔥 https://github.com/JunMing27/CVE/blob/main/CVE%20-%20classroombookings%20Cross%20Site%20Scripting%20(XSS)%20at%20custom%20field.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9806 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9806 · Vendor Advisory
• https://twitter.com/oktsec/status/1844356744169873617 · Twitter Post
• https://twitter.com/CVEnew/status/1844449227801247808 · Twitter Post
• https://vuldb.com/?ctiid.279958 · Note
• https://vuldb.com/?id.279958 · Note
• https://vuldb.com/?submit.418715 · Note
• https://t.me/cvenotify/98508 · Telegram Post
• https://t.me/cvedetector/7628 · Telegram Post