CVE-2020-24609
MEDIUMSavsoft Quiz < 5.5 - Stored Cross-Site Scripting in User Registration
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-24609. PoCs published by Hemant Patidar, Mayur Parmar.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in Savsoft Quiz Enterprise 5.5, where malicious scripts injected into the 'First Name' and 'Last Name' fields during user registration are executed when an admin views the user management section.
Description
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.
Exploits (2)
This exploit demonstrates a stored XSS vulnerability in Savsoft Quiz Enterprise 5.5, where malicious scripts injected into the 'First Name' and 'Last Name' fields during user registration are executed when an admin views the user management section.
This exploit demonstrates a stored XSS vulnerability in Savsoft Quiz 5.0, where malicious scripts injected into the 'First Name' and 'Last Name' fields during user registration are executed when an admin views the user management section.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N