Cross-Site Scripting Vulnerability in Online Birth Certificate System by Unknown Vendor
CVE-2020-29239

6.1MEDIUM

Key Information:

Vendor

Janobe

Status
Online Voting System
Vendor
CVE Published:
2 December 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-29239?

The Online Birth Certificate System Project version 1.0 is susceptible to a cross-site scripting vulnerability that allows an attacker to inject malicious code through the User Registration section. This exploitation can occur when an administrator accesses the View Detail of Application section in the admin panel, enabling the attacker to steal cookies by leveraging specifically crafted payloads. Such vulnerabilities pose significant risks, particularly in systems handling sensitive user information.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-29239 - Proof of Concept

References

https://www.exploit-db.com/exploits/49159
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.