Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/carpenter/ | Exploit Third Party Advisory |
| https://projectworlds.in/ | Product |
| https://fluidattacks.com/advisories/carpenter/ | Exploit Third Party Advisory |
| https://projectworlds.in/ | Product |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:25
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. | |
| References | () https://fluidattacks.com/advisories/carpenter/ - Exploit, Third Party Advisory | |
| References | () https://projectworlds.in/ - Product |
02 Jan 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-31 22:15
Updated : 2024-11-21 08:25
NVD link : CVE-2023-44484
Mitre link : CVE-2023-44484
CVE.ORG link : CVE-2023-44484
JSON object : View
Products Affected
projectworlds
- online_blood_donation_management_system
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')