CVE-2017-5631

MEDIUMNuclei

KMCIS CaseAware - Cross-Site Scripting

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-5631 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBKMCIS CaseAware - Cross-Site ScriptingExploitDB exploitby justpentestNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMKMCIS CaseAware - Cross-Site ScriptingCVSS 6.1

KMCIS CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

To remediate this vulnerability, it is recommended to apply the latest patches or updates provided by the vendor.

WeaknessesCWE-79
Authorsedoardottt
Template tagscve2017cveedbxsscaseawarekmc_information_systemsvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:kmc_information_systems:caseaware:-:*:*:*:*:*:*:*
FOFA: title="caseaware"
https://www.openbugbounty.org/incidents/228262/ https://www.exploit-db.com/exploits/42042/ https://nvd.nist.gov/vuln/detail/CVE-2017-5631 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3