| Titolo | PHPGurukul Online Notes Sharing System 1.0 Improper Neutralization of Data within XPath Expressions |
|---|
| Descrizione | A critical vulnerability was discovered in the PHP Gurukul - Online Notes Sharing System, a web application designed to manage and share academic notes among students and faculty. The vulnerability affects the session management logic handled via cookies and specifically targets the sessionid cookie used during authentication and user tracking.
The flaw allows attackers to perform XPath Injection by supplying specially crafted values in the sessionid cookie. Due to improper neutralization of input within XPath expressions, the application becomes vulnerable to logic manipulation, authentication bypass, and potential data extraction from the backend XML data store (e.g., usernames, passwords). |
|---|
| Fonte | ⚠️ https://github.com/Vanshdhawan188/Online-Notes-Sharing-System-Php-Gurukul-Python/blob/main/Online-Notes-Sharing-System-Php-Gurukul-Python-Xpath-Injection.md |
|---|
| Utente | Subhash Paudel (UID 66830) |
|---|
| Sottomissione | 29/06/2025 13:46 (1 Anno fa) |
|---|
| Moderazione | 07/07/2025 08:02 (8 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 315093 [PHPGurukul Online Notes Sharing System 1.0 Cookie /Dashboard sessionid iniezione SQL] |
|---|
| Punti | 20 |
|---|