| Название | PHPGurukul Online Notes Sharing System 1.0 Improper Neutralization of Data within XPath Expressions |
|---|
| Описание | A critical vulnerability was discovered in the PHP Gurukul - Online Notes Sharing System, a web application designed to manage and share academic notes among students and faculty. The vulnerability affects the session management logic handled via cookies and specifically targets the sessionid cookie used during authentication and user tracking.
The flaw allows attackers to perform XPath Injection by supplying specially crafted values in the sessionid cookie. Due to improper neutralization of input within XPath expressions, the application becomes vulnerable to logic manipulation, authentication bypass, and potential data extraction from the backend XML data store (e.g., usernames, passwords). |
|---|
| Источник | ⚠️ https://github.com/Vanshdhawan188/Online-Notes-Sharing-System-Php-Gurukul-Python/blob/main/Online-Notes-Sharing-System-Php-Gurukul-Python-Xpath-Injection.md |
|---|
| Пользователь | Subhash Paudel (UID 66830) |
|---|
| Представление | 29.06.2025 13:46 (1 Год назад) |
|---|
| Модерация | 07.07.2025 08:02 (8 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 315093 [PHPGurukul Online Notes Sharing System 1.0 Cookie /Dashboard sessionid SQL-инъекция] |
|---|
| Баллы | 20 |
|---|