| タイトル | PHPGurukul Online Notes Sharing System 1.0 Improper Neutralization of Data within XPath Expressions |
|---|
| 説明 | A critical vulnerability was discovered in the PHP Gurukul - Online Notes Sharing System, a web application designed to manage and share academic notes among students and faculty. The vulnerability affects the session management logic handled via cookies and specifically targets the sessionid cookie used during authentication and user tracking.
The flaw allows attackers to perform XPath Injection by supplying specially crafted values in the sessionid cookie. Due to improper neutralization of input within XPath expressions, the application becomes vulnerable to logic manipulation, authentication bypass, and potential data extraction from the backend XML data store (e.g., usernames, passwords). |
|---|
| ソース | ⚠️ https://github.com/Vanshdhawan188/Online-Notes-Sharing-System-Php-Gurukul-Python/blob/main/Online-Notes-Sharing-System-Php-Gurukul-Python-Xpath-Injection.md |
|---|
| ユーザー | Subhash Paudel (UID 66830) |
|---|
| 送信 | 2025年06月29日 13:46 (1 年 ago) |
|---|
| モデレーション | 2025年07月07日 08:02 (8 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 315093 [PHPGurukul Online Notes Sharing System 1.0 Cookie /Dashboard sessionid SQLインジェクション] |
|---|
| ポイント | 20 |
|---|