Stored Cross-Site Scripting Vulnerability in Sourcecodester School Task Manager
CVE-2024-28277

6.1MEDIUM

Key Information:

Vendor
Sourcecodester
Status
School Task Manager
Vendor
CVE Published:
14 May 2024

Summary

A security vulnerability exists in Sourcecodester's School Task Manager version 1.0 that allows for Stored Cross-Site Scripting (XSS) attacks through the subject_name parameter. This flaw enables attackers to insert and store malicious JavaScript payloads by manipulating the subject name. When users render this data, the executed scripts can lead to unauthorized actions, data theft, and potential compromise of user accounts. Immediate remediation is necessary to mitigate any risk of exploitation.

References

https://www.sourcecodester.com/download-code?nid=16877&ti...
https://github.com/unrealjbr/CVE-2024-28277

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.