INCIBECVELIST:CVE-2024-4823CVE-2024-4823 Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.2%
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index ‘/schoolerp/office_admin/’ in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "School ERP Pro+Responsive",
"vendor": "AROX SOLUTION",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
]Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
0.0004 Low
EPSS
Percentile
9.2%