Vulners
Lucene search
Alumni Management System 1.0 Cross Site Scripting
🗓️ 17 Dec 2020 00:00:00Reported by Valerio AlessandroniType 
packetstorm🔗 packetstormsecurity.com👁 185 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2020-28071 | 23 Dec 202021:12 | – | circl |
 | Sourcecodester Alumni Management System 跨站脚本漏洞 | 17 Dec 202000:00 | – | cnnvd |
 | Sourcecodester Alumni Management System Cross-Site Scripting Vulnerability | 23 Dec 202000:00 | – | cnvd |
 | CVE-2020-28071 | 23 Dec 202017:54 | – | cve |
 | CVE-2020-28071 | 23 Dec 202017:54 | – | cvelist |
 | EUVD-2020-20559 | 7 Oct 202500:30 | – | euvd |
 | CVE-2020-28071 | 23 Dec 202018:15 | – | nvd |
 | CVE-2020-28071 | 23 Dec 202018:15 | – | osv |
 | Cross site scripting | 23 Dec 202018:15 | – | prion |
 | CVE-2020-28071 | 22 May 202515:28 | – | redhatcve |
10
`# Exploit Title: Stored XSS on Alumni Management System
# Date: 23/10/2020
# Exploit Author: Valerio Alessandroni
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-s ource-code.html
# Version: 1.0
# Tested on: ubuntu 18.04
# CVE : CVE-2020-28071
# Description:
An attacker after the admin authentication, can upload an image in the gallery, using a XSS payload in the description textarea called "about" and reach a stored XSS.
# Reproduction:
- Login as "admin"
- upload an image in the gallery area in the administration panel injecting Javascript code in the textarea called "about"
- The obtained XSS affects the administration panel (ex: http://127.0.0.1/admin/index.php?page=gallery) and
the public gallery (ex: http://127.0.0.1/index.php?page=gallery)
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Dec 2020 00:00Current
5.3Medium risk
Vulners AI Score5.3
EPSS0.00288