| शीर्षक | CampCodes School Management Software 1.0 Account Takeover Possibility via Stored Cross Site Scripting |
|---|
| विवरण | Vendor and Product Information:
Vendor: CampCodes
Product: School Management Software
Product URL: https://www.campcodes.com/downloads/school-management-software-in-php-mysql-full-source-code/
Vulnerability Name: Account Takeover Possibility via Stored Cross Site Scripting
Description:
The application’s calendar module “/academic calendar” is vulnerable to cross site scripting. Teachers can view the calendar module and add an event to the calendar. The same event can then be seen in another teacher’s calendar. Since the calendar module is vulnerable to XSS, one teacher can exploit this vulnerability and potentially steal another teacher’s session cookie to perform account takeover.
Payload:
<img src=x onerror=alert(document.cookie)> |
|---|
| स्रोत | ⚠️ https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Stored%20Cross%20Site%20Scripting-%20Teachers%20Account%20Takeover%20Possibility.pdf |
|---|
| उपयोगकर्ता | khukuririmal (UID 80171) |
|---|
| सबमिशन | 02/02/2025 12:27 PM (2 साल पहले) |
|---|
| संयम | 10/02/2025 09:02 AM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 295063 [CampCodes School Management Software 1.0 /academic-calendar क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|