Lucene search

VulDBCVE-2024-1871

HistoryFeb 26, 2024 - 4:27 p.m.

CVE-2024-1871

2024-02-2616:27:53

CWE-79

VulDB

web.nvd.nist.gov

cve-2024-1871

vulnerability

sourcecodester

employee management system

cross site scripting

remote attack

vdb-254694

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. Affected is an unknown function of the file /process/assignp.php of the component Project Assignment Report. The manipulation of the argument pname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254694 is the identifier assigned to this vulnerability.

Affected configurations

Vulners

Vulnrichment

Node

sourcecodesteremployee_management_systemMatch1.0

VendorProductVersionCPE
sourcecodesteremployee_management_system1.0cpe:2.3:a:sourcecodester:employee_management_system:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sourcecodester	employee_management_system	1.0	cpe:2.3:a:sourcecodester:employee_management_system:1.0:::::::*

CNA Affected

[
  {
    "vendor": "SourceCodester",
    "product": "Employee Management System",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ],
    "modules": [
      "Project Assignment Report"
    ]
  }
]

References

github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20EMPLOYEE%20MANAGEMENT%20SYSTEM/XSS%20Vulnerability%20in%20Project%20Assignment%20Report.md

vuldb.com/?ctiid.254694

vuldb.com/?id.254694

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-1871