vendor:
CASAP Automated Enrollment System
by:
Richard Jones
8.8
CVSS
HIGH
Stored XSS
79
CWE
Product Name: CASAP Automated Enrollment System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:casap_automated_enrollment_system:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34
2021
CASAP Automated Enrollment System 1.0 – ‘route’ Stored XSS
A stored XSS vulnerability exists in the CASAP Automated Enrollment System 1.0, which allows an attacker to inject malicious JavaScript code into the 'route' field of the student's profile. By logging in with the username 'admin' and password `' or 1=1#, an attacker can exploit this vulnerability by entering a malicious script into the 'route' field and saving it. When the page is reloaded, the malicious script will be executed.
Mitigation:
Input validation should be used to prevent malicious code from being injected into the 'route' field. Additionally, access to the admin account should be restricted to only authorized personnel.
