SourceCodester Profile Registration 1.0 add.php Cross-Site Scripting (CVE-2024-9799)

Key Information 1. Vulnerability ID: - VDB-279949 - CVE-2024-9799 2. Vulnerability Name: - SourceCodester Profile Registration without Reload Refresh 1.0 Add.php Cross Site Scripting 3. CVSS Meta Temp Score: - 3.2 4. Current Exploit Price: - $0-$5k 5. CTI Interest Score: - 1.12 6. Affected File: - add.php 7. Vulnerability Description: - An unknown code block in the add.php file allows Cross-Site Scripting (XSS) attacks via manipulation of parameters such as email address, address, company name, position, and job description, using unknown input. 8. CWE Definition: - CWE-79 9. Product Information: - The product fails to neutralize or improperly neutralizes user-controllable input, resulting in output being used in a web page accessible to other users. This impacts integrity. 10. Exploit Difficulty: - Low exploit difficulty - Attack can be initiated remotely - Requires some user interaction from the victim 11. Technical Details and Public Exploits: - Known technical details - Known public exploits available 12. MITRE ATT&CK Technique: - Uses attack technique T1059.007 13. Exploit Download: - Exploit can be downloaded from gist.github.com 14. Search for Exploitable Targets: - Targets can be found by searching for "inurl:add.php" 15. Possible Mitigations: - Replace affected components is recommended 16. Related Vulnerability IDs: - VDB-83007 - VDB-83329 - VDB-83613 - VDB-152063 Summary This vulnerability is a Cross-Site Scripting (XSS) flaw affecting the add.php file in SourceCodester Profile Registration without Reload Refresh 1.0. The exploit difficulty is low, and public exploits are available. It is recommended to replace the affected components to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

SourceCodester Profile Registration 1.0 add.php Cross-Site Scripting (CVE-2024-9799)