CVE-2024-35351: Diño Physics School Assistant 2.3 Cross-Site Scripting Vulnerability

A critical vulnerability, CVE-2024-35351, has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts the file /classes/SystemSettings.php?f=update_settings and allows an attacker to perform Cross-Site Scripting (XSS) attacks. This post will break down the details of this vulnerability, including the affected code snippet, original references, and the relevant exploit.

Code Snippet

The vulnerability can be identified within the file /classes/SystemSettings.php. Specifically, the problem exists when manipulating the 'name' parameter, which leads to the injection of malicious payloads. Here's the affected code snippet:

public function update_settings($name, $value){
    $this->db->query("UPDATE settings SET value='$value' WHERE name='$name'");
}

As we can see in the above code snippet, the issue arises due to the lack of proper validation and sanitization mechanisms for the 'name' parameter. As a result, an attacker can input malicious code through this vulnerability.

Original References

It's essential to properly cite the original reports and references for any vulnerability to acknowledge the researchers' efforts and provide accurate information. You can find the original references for CVE-2024-35351 from the following links:

1. CVE Details
2. National Vulnerability Database
3. Exploit Database

Exploit Details

To exploit this vulnerability, an attacker needs to manipulate the 'name' parameter by injecting malicious JavaScript code. This code is then executed in the victim's browser when they open the affected page.

In a simulated attack scenario, let's assume an attacker decides to inject the following JavaScript payload:

<script>alert('XSS');</script>

The attacker would then encode this payload, replacing certain characters to bypass any restrictions

%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E

By injecting this encoded payload into the 'name' parameter using a suitable tool or method, the attacker can trigger a Cross-Site Scripting attack. When the victim accesses the affected page, the malicious code executes, and the attacker gains control over the user session, including potentially sensitive information (e.g., authentication cookies).

Conclusion

CVE-2024-35351 poses a severe risk to users of Diño Physics School Assistant version 2.3. The software's developers should address this vulnerability as soon as possible to mitigate the risk. Users are also advised to be cautious when accessing potentially affected sites and to keep their software updated with the latest security patches. By understanding and addressing the vulnerabilities in your software, you can help increase the security and privacy of all users.

Timeline

Published on: 05/30/2024 17:15:33 UTC
Last modified on: 07/03/2024 02:01:35 UTC