Student Information System 1.0 Student Roll Module admin/ cross site scripting

EntryHistoryDiffjsonxmlCTI

A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is an unknown function of the file admin/?page=students of the component Student Roll Module. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. Using CWE to declare the problem leads to CWE-79. The weakness was released 05/24/2022. The advisory is available at github.com. This vulnerability is traded as CVE-2022-1819. It is possible to launch the attack remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project. It is declared as proof-of-concept. The exploit is shared for download at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	34

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_cna_basescore	1
source_cve_cna	1
vulnerability_cvss3_cna_a	1
vulnerability_cvss3_cna_i	1

Commit Conf

90%	32
70%	11
50%	10
100%	1

Approve Conf

90%	32
70%	11
80%	10
100%	1

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
12560723	05/29/2022	VulD...	cvss3_cna_basescore	2.4	see CVSS documentation	05/29/2022	accepted	90
12560722	05/29/2022	VulD...	cvss3_meta_tempscore	2.3	see CVSS documentation	05/29/2022	accepted	90
12560721	05/29/2022	VulD...	cve_cna	VulDB	nvd.nist.gov	05/29/2022	accepted	70
12560720	05/29/2022	VulD...	cvss3_cna_a	N	nvd.nist.gov	05/29/2022	accepted	70
12560719	05/29/2022	VulD...	cvss3_cna_i	L	nvd.nist.gov	05/29/2022	accepted	70
12560718	05/29/2022	VulD...	cvss3_cna_c	N	nvd.nist.gov	05/29/2022	accepted	70
12560717	05/29/2022	VulD...	cvss3_cna_s	U	nvd.nist.gov	05/29/2022	accepted	70
12560716	05/29/2022	VulD...	cvss3_cna_ui	R	nvd.nist.gov	05/29/2022	accepted	70
12560715	05/29/2022	VulD...	cvss3_cna_pr	H	nvd.nist.gov	05/29/2022	accepted	70
12560714	05/29/2022	VulD...	cvss3_cna_ac	L	nvd.nist.gov	05/29/2022	accepted	70
12560713	05/29/2022	VulD...	cvss3_cna_av	N	nvd.nist.gov	05/29/2022	accepted	70
12560712	05/29/2022	VulD...	cve_nvd_summary	A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module. The manipulation with the input alert(1) leads to authenticated cross site scripting. Exploit details have been disclosed to the public.	cve.mitre.org	05/29/2022	accepted	70
12560711	05/29/2022	VulD...	cve_assigned	1653256800 (05/23/2022)	cve.mitre.org	05/29/2022	accepted	70
12547112	05/24/2022	VulD...	input_value	<script>alert(1)</script>		05/24/2022	accepted	100
12547111	05/24/2022	VulD...	price_0day	$0-$5k	see exploit price documentation	05/24/2022	accepted	90
12547110	05/24/2022	VulD...	cvss3_meta_tempscore	2.2	see CVSS documentation	05/24/2022	accepted	90
12547109	05/24/2022	VulD...	cvss3_meta_basescore	2.4	see CVSS documentation	05/24/2022	accepted	90
12547108	05/24/2022	VulD...	cvss3_vuldb_tempscore	2.2	see CVSS documentation	05/24/2022	accepted	90
12547107	05/24/2022	VulD...	cvss3_vuldb_basescore	2.4	see CVSS documentation	05/24/2022	accepted	90
12547106	05/24/2022	VulD...	cvss2_vuldb_tempscore	2.8	see CVSS documentation	05/24/2022	accepted	90