PT-2024-39852 · Craig Rodway · Classroombookings

Scream3Gg · Published 2024-10-10 · Updated 2024-10-17 · CVE-2024-9807

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craig Rodway Classroombookings version 2.8.7

Description A vulnerability was found in the processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely.

Recommendations For version 2.8.7, upgrade to version 2.8.8 to address this issue. As a temporary workaround, consider restricting access to the /sessions endpoint until the issue is resolved. Avoid using the Name argument in the affected Session Page component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9807

Affected Products

Classroombookings

References · 9

• 🔥 https://github.com/JunMing27/CVE/blob/main/CVE%20-%20classroombookings%20Cross%20Site%20Scripting%20(XSS)%20at%20create%20and%20edit%20session%20page%20via%20Administrator%20Dashboard.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-9807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9807 · Security Note
• https://vuldb.com/?id.279959 · Note
• https://twitter.com/CVEnew/status/1844456204984050098 · Twitter Post
• https://vuldb.com/?submit.419262 · Note
• https://vuldb.com/?ctiid.279959 · Note
• https://t.me/cvedetector/7629 · Telegram Post
• https://t.me/cvenotify/98509 · Telegram Post