CVE-2024-2063

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2063
A vulnerability, which was classified as problematic, was found in SourceCodester Petrol Pump Management Software 1.0. Affected is an unknown function of the file /admin/app/profile_crud.php. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255378 is the identifier assigned to this vulnerability.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md Broken Link
https://vuldb.com/?ctiid.255378 Third Party Advisory
https://vuldb.com/?id.255378 Third Party Advisory
https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md Broken Link
https://vuldb.com/?ctiid.255378 Third Party Advisory
https://vuldb.com/?id.255378 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mayurik:petrol_pump_management:1.0:*:*:*:*:*:*:*
History

12 Dec 2024, 14:52

Type Values Removed Values Added
First Time Mayurik petrol Pump Management
Mayurik
CPE cpe:2.3:a:mayurik:petrol_pump_management:1.0:*:*:*:*:*:*:*
References () https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md - () https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md - Broken Link
References () https://vuldb.com/?ctiid.255378 - () https://vuldb.com/?ctiid.255378 - Third Party Advisory
References () https://vuldb.com/?id.255378 - () https://vuldb.com/?id.255378 - Third Party Advisory

21 Nov 2024, 09:08

Type Values Removed Values Added
References () https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md - () https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/SOURCECODESTER%20Petrol%20pump%20management%20software/profile_crud.php%20Unauthenticated%20STORED%20XSS.md -
References () https://vuldb.com/?ctiid.255378 - () https://vuldb.com/?ctiid.255378 -
References () https://vuldb.com/?id.255378 - () https://vuldb.com/?id.255378 -

21 Mar 2024, 02:52

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en SourceCodester Petrol Pump Management Software 1.0 y clasificada como problemática. Una función desconocida del archivo /admin/app/profile_crud.php es afectada por esta vulnerabilidad. La manipulación del argumento nombre de usuario conduce a Cross-Site Scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-255378 es el identificador asignado a esta vulnerabilidad.

01 Mar 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-01 13:15

Updated : 2024-12-12 14:52

NVD link : CVE-2024-2063

Mitre link : CVE-2024-2063

CVE.ORG link : CVE-2024-2063

JSON object : View

Products Affected

mayurik

  • petrol_pump_management
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')