Cross-Site Scripting and Cross-Site Request Forgery Issues in Hostel Management System by an Unspecified Vendor
CVE-2021-43137

8.8HIGH

Key Information:

Vendor
PHPgurukul
Status
Hostel Management System
Vendor
CVE Published:
1 December 2021

Summary

A notable security flaw has been identified in the Hostel Management System version 2.1, which exposes users to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities. These vulnerabilities manifest through the name field in the my-profile.php file, enabling potential attackers to exploit them. When combined, these weaknesses can lead to unauthorized account access, jeopardizing the integrity and confidentiality of user information.

References

https://www.exploit-db.com/exploits/50461
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.