vendor:
CourseMS
by:
cptsticky
8.8
CVSS
HIGH
Stored XSS
79
CWE
Product Name: CourseMS
Affected Version From: 2.1
Affected Version To: 2.1
Patch Exists: NO
Related CWE: N/A
CPE: a:sourceforge:coursems:2.1
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Ubuntu 20.04
2021
CourseMS 2.1 – ‘name’ Stored XSS
A stored XSS vulnerability exists in CourseMS 2.1, which allows an attacker to inject malicious JavaScript code into the 'name' parameter of the add_jobs.php page. When a user visits the add_user.php page, the malicious code is executed, allowing the attacker to access the user's cookies.
Mitigation:
Input validation should be used to prevent malicious code from being injected into the 'name' parameter. Additionally, the application should be configured to use a Content Security Policy (CSP) to prevent the execution of malicious code.
