SourceCodester Wedding Hall Booking System Staff User Profile /whbs/admin/ First Name/Last Name cross site scripting

EntryHistoryDiffjsonxmlCTI

A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Hall Booking System. This affects an unknown part of the file /whbs/admin/?page=user of the component Staff User Profile. The manipulation of the argument First Name/Last Name leads to cross site scripting. The CWE definition for the vulnerability is CWE-79. The weakness was published 08/06/2022. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-2692. It is possible to initiate the attack remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The pricing for an exploit might be around USD $0-$5k at the moment. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK. It is declared as proof-of-concept. The exploit is shared for download at github.com. We expect the 0-day to have been worth approximately $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	41

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_meta_basescore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss3_nvd_basescore	1
source_cve_cna	1

Commit Conf

90%	34
70%	19
50%	11

Approve Conf

90%	34
70%	19
80%	11

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
12927983	08/31/2022	VulD...	cvss3_cna_basescore	3.5	see CVSS documentation	08/31/2022	accepted	90
12927982	08/31/2022	VulD...	cvss3_nvd_basescore	5.4	nist.gov	08/31/2022	accepted	90
12927981	08/31/2022	VulD...	cvss3_meta_tempscore	4.0	see CVSS documentation	08/31/2022	accepted	90
12927980	08/31/2022	VulD...	cvss3_meta_basescore	4.1	see CVSS documentation	08/31/2022	accepted	90
12927979	08/31/2022	VulD...	cve_cna	VulDB	nvd.nist.gov	08/31/2022	accepted	70
12927978	08/31/2022	VulD...	cvss3_cna_a	N	nvd.nist.gov	08/31/2022	accepted	70
12927977	08/31/2022	VulD...	cvss3_cna_i	L	nvd.nist.gov	08/31/2022	accepted	70
12927976	08/31/2022	VulD...	cvss3_cna_c	N	nvd.nist.gov	08/31/2022	accepted	70
12927975	08/31/2022	VulD...	cvss3_cna_s	U	nvd.nist.gov	08/31/2022	accepted	70
12927974	08/31/2022	VulD...	cvss3_cna_ui	R	nvd.nist.gov	08/31/2022	accepted	70
12927973	08/31/2022	VulD...	cvss3_cna_pr	L	nvd.nist.gov	08/31/2022	accepted	70
12927972	08/31/2022	VulD...	cvss3_cna_ac	L	nvd.nist.gov	08/31/2022	accepted	70
12927971	08/31/2022	VulD...	cvss3_cna_av	N	nvd.nist.gov	08/31/2022	accepted	70
12927970	08/31/2022	VulD...	cvss3_nvd_a	N	nvd.nist.gov	08/31/2022	accepted	70
12927969	08/31/2022	VulD...	cvss3_nvd_i	L	nvd.nist.gov	08/31/2022	accepted	70
12927968	08/31/2022	VulD...	cvss3_nvd_c	L	nvd.nist.gov	08/31/2022	accepted	70
12927967	08/31/2022	VulD...	cvss3_nvd_s	C	nvd.nist.gov	08/31/2022	accepted	70
12927966	08/31/2022	VulD...	cvss3_nvd_ui	R	nvd.nist.gov	08/31/2022	accepted	70
12927965	08/31/2022	VulD...	cvss3_nvd_pr	L	nvd.nist.gov	08/31/2022	accepted	70
12927964	08/31/2022	VulD...	cvss3_nvd_ac	L	nvd.nist.gov	08/31/2022	accepted	70