Stored Cross-Site Scripting Vulnerability in KASHIPARA E-learning Management System
CVE-2024-50839

Currently unrated

Key Information:

Vendor

KASHIPARA

Status
E-learning Management System
Vendor
CVE Published:
14 November 2024

What is CVE-2024-50839?

A vulnerability exists in the KASHIPARA E-learning Management System that enables remote attackers to exploit the application via stored input fields. By manipulating the 'subject_code' and 'title' parameters in the /admin/add_subject.php endpoint, attackers can inject arbitrary JavaScript code, leading to unauthorized execution of scripts on victim browsers when they access the compromised data. Implementing necessary input validation and output encoding practices is essential to mitigate this security risk.

References

https://github.com/m14r41/Writeups/blob/main/CVE/Kashipar...

Timeline

  • Vulnerability published

.
CVE-2024-50839 : Stored Cross-Site Scripting Vulnerability in KASHIPARA E-learning Management System