CVE-2024-7218

July 30, 2024, 1:32 p.m.

3.5
Low

Description

A vulnerability was found in SourceCodester School Log Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/ajax.php?action=save_student. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272789 was assigned to this vulnerability.

Product(s) Impacted

Product Versions
SourceCodester School Log Management System
  • 1.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://gist.github.com/topsky979/86480890cc621c240c86e95a3de9ecc4
https://vuldb.com/?ctiid.272789
https://vuldb.com/?id.272789
https://vuldb.com/?submit.380425

Tags

CWE-79
cna@vuldb.com
2024-07-30
CVE-2024-7218

CVSS Score

3.5 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: July 30, 2024, 5:15 a.m.
Last Modified: July 30, 2024, 1:32 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@vuldb.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.