Skip to main content

CVE-2024-6807

 

Details​

Attack type: Cross Site Scripting

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vendor: SourceCodester

Product: Student Study Center Desk Management System

Affected components: /sscdms/classes/Users.php?f=save

XSS injection parameters: firstname, middlename, lastname, username

 

POC​

1

Click on Create New.

2

Intercept the request using Burpsuite Proxy.

3

Change the firstname parameter to the following:

<script>print();</script>

4

Send the request and reload the page.

5