CVE-2023-34666

MEDIUM

Phpgurukul Cyber Cafe Management System 1.0 - Cross-Site Scripting via Admin Username Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-34666. PoCs published by Pruthvi Nekkanti.

AI-analyzed exploit summary This is a writeup describing a persistent XSS vulnerability in Cyber Cafe Management System 1.0, where an attacker can inject malicious JavaScript into the admin username field to steal cookies. The payload provided is a simple alert-based XSS proof-of-concept.

Description

Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter.

Exploits (1)

exploitdb WRITEUP
by Pruthvi Nekkanti · textwebappsphp
https://www.exploit-db.com/exploits/49204

This is a writeup describing a persistent XSS vulnerability in Cyber Cafe Management System 1.0, where an attacker can inject malicious JavaScript into the admin username field to steal cookies. The payload provided is a simple alert-based XSS proof-of-concept.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Cyber Cafe Management System (CCMS) 1.0
Auth required
Prerequisites: Admin access to modify the username field
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/49204

Scores

CVSS v3 6.1
EPSS 0.0067
EPSS Percentile 47.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
phpgurukul/cyber_cafe_management_system 1.0
Published Jun 15, 2023
Tracked Since Feb 18, 2026