Cross-Site Scripting (XSS) Vulnerability in AMSS++ version 4.31
CVE-2024-2597
6.1MEDIUM
What is CVE-2024-2597?
A vulnerability exists in the AMSS++ application version 4.31 due to insufficient encoding of user-controlled input. Specifically, the flaw is found in the endpoint /amssplus/modules/book/main/bookdetail_school_person.php, where the 'b_id' parameter fails to properly sanitize input. This weakness enables remote attackers to craft malicious URLs that, when accessed by an authenticated user, can lead to the theft of session cookie credentials, compromising user sessions and leading to unauthorized access.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
AMSS++ 4.31
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Rafael Pedrero