CVE-2020-15716

MEDIUM

RosarioSIS 6.7.2 - Cross-Site Scripting via Preferences.php Tab Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-15716. PoCs published by CodeSecLab.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in RosarioSIS 6.7.2 via the 'tab' parameter in the 'Modules.php' endpoint. The payload triggers when a user hovers over the injected element, requiring authentication and the absence of the 'modfunc' parameter.

Description

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.

Exploits (1)

exploitdb WORKING POC

by CodeSecLab · textwebappsphp

https://www.exploit-db.com/exploits/52450

View Code ZIP pw:eip

This exploit demonstrates a stored XSS vulnerability in RosarioSIS 6.7.2 via the 'tab' parameter in the 'Modules.php' endpoint. The payload triggers when a user hovers over the injected element, requiring authentication and the absence of the 'modfunc' parameter.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: RosarioSIS 6.7.2

Auth required

Prerequisites: Authenticated session · Absence of 'modfunc' parameter

MITRE ATT&CK