A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attacker website.
References
| Link | Resource |
|---|---|
| http://web-school.in | Product |
| https://github.com/0xrayan/CVEs/issues/1 | Exploit Issue Tracking Third Party Advisory |
| https://web-school.in/try-demo/ | Product |
| http://web-school.in | Product |
| https://github.com/0xrayan/CVEs/issues/1 | Exploit Issue Tracking Third Party Advisory |
| https://web-school.in/try-demo/ | Product |
Configurations
History
21 Nov 2024, 06:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://web-school.in - Product | |
| References | () https://github.com/0xrayan/CVEs/issues/1 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://web-school.in/try-demo/ - Product |
Information
Published : 2021-04-08 12:15
Updated : 2024-11-21 06:03
NVD link : CVE-2021-30113
Mitre link : CVE-2021-30113
CVE.ORG link : CVE-2021-30113
JSON object : View
Products Affected
web-school
- enterprise_resource_planning
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')