CVE-2024-35352 - Cross-Site Scripting Vulnerability Discovered in Diño Physics School Assistant Version 2.3

A new vulnerability, labeled as CVE-2024-35352, has been discovered in the Diño Physics School Assistant software, which is widely used by teachers for simplifying the understanding of physics concepts for students. This vulnerability has been identified in version 2.3 of the software and potentially leaves users exposed to malicious code injection and unauthorized actions on their accounts.

Details

The vulnerability has been found within a file named /classes/Users.php?f=save in the Diño Physics School Assistant version 2.3 software. Researchers have uncovered that by manipulating the middlename parameter used by the software, an attacker could potentially inject malicious code which results in cross-site scripting (XSS).

Cross-site scripting means that an attacker could execute malicious scripts in the victim's browser, resulting in various security risks, such as unauthorized access to user accounts, unauthorized actions performed on behalf of the user, or even the stealing of sensitive information.

Here is a code snippet showcasing the vulnerable portion of the code

/classes/Users.php?f=save
...
$firstname = $_POST['firstname'];
$middlename = $_POST['middlename'];
$lastname = $_POST['lastname'];
...

Exploit

The exploit for this vulnerability can be executed by sending a malicious payload in the middlename parameter, which, in turn, can lead to the execution of malicious scripts on the victim's browser.

Below is an example of a potential payload that exploits the vulnerability

<script>alert('XSS Attack!')</script>

By injecting this payload as a value in the middlename parameter, an attacker can execute the script in the user's browser, revealing the presence of the XSS vulnerability.

Mitigation

To mitigate this vulnerability, users should avoid using version 2.3 of the Diño Physics School Assistant software until the developers have released a patch addressing the issue. In the meantime, users should also follow best security practices, such as enabling browser features that prevent cross-site scripting attacks and regularly updating their browser and software to the latest versions.

For more information on the CVE-2024-35352 vulnerability, please refer to the following links

1. CVE-2024-35352 Official Listing
2. Diño Physics School Assistant Official Website
3. OWASP Cross-site Scripting (XSS) Prevention Cheat Sheet

Conclusion

In conclusion, the discovered vulnerability, CVE-2024-35352, in Diño Physics School Assistant version 2.3 poses a severe risk to its users. It is highly recommended to avoid using the affected version and keep up-to-date on security releases from the developers. By following best security practices, users can protect themselves from potential attacks stemming from this vulnerability.

Timeline

Published on: 05/30/2024 17:15:33 UTC
Last modified on: 07/03/2024 02:01:35 UTC