Cross Site Scripting Vulnerability in SourceCodester Online Eyewear Shop
CVE-2024-11247

5.4MEDIUM

Key Information:

Vendor

Oretnom23

Status
Online Eyewear Shop
Vendor
CVE Published:
15 November 2024

What is CVE-2024-11247?

A Cross Site Scripting vulnerability exists in the SourceCodester Online Eyewear Shop version 1.0, specifically within the functionality of the file /oews/classes/Master.php?f=save_product. The vulnerability is triggered through the manipulation of the 'brand' argument, allowing attackers to inject malicious scripts. This attack can be initiated remotely, posing a significant risk to users and administrators. Additional parameters may also be susceptible to similar exploits, emphasizing the need for immediate security attention.

References

https://vuldb.com/?id.284683
https://vuldb.com/?ctiid.284683
https://vuldb.com/?submit.443194

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.