RosarioSIS Vulnerable to Cross-Site Scripting Attacks
CVE-2024-3138

3.5LOW

Key Information:

Vendor

Francoisjacquet

Status
RosariOSis
Vendor
CVE Published:
1 April 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-3138?

A potential cross site scripting vulnerability has been identified in the Add Portal Note component of francoisjacquet RosarioSIS version 11.5.1. This issue allows for unwanted manipulation of user input, which could lead to exploitation via malicious scripts. Although the vulnerability has been publicly disclosed, its existence is under dispute, with the vendor stating that the application operates within a sandbox environment when opening PDFs, thereby limiting access to the overarching system data. Users should remain vigilant and consider mitigation strategies in light of this potential risk.

Affected Version(s)

RosarioSIS 11.5.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-3138 - Proof of Concept

References

https://vuldb.com/?id.258911
vdb-entry
https://vuldb.com/?ctiid.258911
signaturepermissions-required
https://vuldb.com/?submit.307450
third-party-advisory

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

louay khammassi (VulDB User)
.