CVE-2024-7914

A vulnerability classified as problematic has been found in SourceCodester Yoga Class Registration System 1.0. Affected is an unknown function of the file /php-ycrs/classes/SystemSettings.php. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS v3 5.4 MEDIUM
CVSS v2.0 4.0 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/Wsstiger/cve/blob/main/Yoga_xss2.md	Exploit
https://vuldb.com/?ctiid.275040	Permissions Required VDB Entry
https://vuldb.com/?id.275040	VDB Entry
https://vuldb.com/?submit.392193	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:oretnom23:yoga_class_registration_system:1.0:*:*:*:*:*:*:*

History

19 Aug 2024, 16:12

Type	Values Removed	Values Added
First Time		Oretnom23 yoga Class Registration System Oretnom23
References	~~() https://github.com/Wsstiger/cve/blob/main/Yoga_xss2.md -~~	() https://github.com/Wsstiger/cve/blob/main/Yoga_xss2.md - Exploit
References	~~() https://vuldb.com/?ctiid.275040 -~~	() https://vuldb.com/?ctiid.275040 - Permissions Required, VDB Entry
References	~~() https://vuldb.com/?id.275040 -~~	() https://vuldb.com/?id.275040 - VDB Entry
References	~~() https://vuldb.com/?submit.392193 -~~	() https://vuldb.com/?submit.392193 - Third Party Advisory, VDB Entry
CVSS	v2 : ~~4.0~~ v3 : ~~3.5~~	v2 : 4.0 v3 : 5.4
CPE		cpe:2.3:a:oretnom23:yoga_class_registration_system:1.0:::::::*

19 Aug 2024, 12:59

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido encontrada en SourceCodester Yoga Class Registration System 1.0 y clasificada como problemática. Una función desconocida del archivo /php-ycrs/classes/SystemSettings.php es afectada por esta vulnerabilidad. La manipulación del argumento dirección conduce a Cross-Site Scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse.

18 Aug 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-18 22:15

Updated : 2024-08-19 16:12

NVD link : CVE-2024-7914

Mitre link : CVE-2024-7914

CVE.ORG link : CVE-2024-7914

JSON object : View

Products Affected

oretnom23

yoga_class_registration_system

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-7914", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 5.3, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-08-18T22:15:12.737", "references": [{"url": "https://github.com/Wsstiger/cve/blob/main/Yoga_xss2.md", "tags": ["Exploit"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.275040", "tags": ["Permissions Required", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.275040", "tags": ["VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.392193", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in SourceCodester Yoga Class Registration System 1.0. Affected is an unknown function of the file /php-ycrs/classes/SystemSettings.php. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en SourceCodester Yoga Class Registration System 1.0 y clasificada como problem\u00e1tica. Una funci\u00f3n desconocida del archivo /php-ycrs/classes/SystemSettings.php es afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento direcci\u00f3n conduce a Cross-Site Scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse."}], "lastModified": "2024-08-19T16:12:51.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oretnom23:yoga_class_registration_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "542DF166-45D2-4387-B56E-36CEAEEC535E"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}

5.4 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2024-7914

5.4^/10

4.0^/10

Attach tags to `CVE-2024-7914`