CVE-2024-34224

HIGH

Computer Laboratory Management System 1.0 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-34224. PoCs published by dovankha.

AI-analyzed exploit summary This repository documents a Cross-Site Scripting (XSS) vulnerability in Computer Laboratory Management System using PHP and MySQL 1.0. The vulnerability occurs in the `/php-lms/classes/Users.php?f=save` endpoint via the `firstname`, `middlename`, and `lastname` parameters, allowing arbitrary script injection.

Description

Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters.

Exploits (1)

nomisec WRITEUP
by dovankha · poc
https://github.com/dovankha/CVE-2024-34224

This repository documents a Cross-Site Scripting (XSS) vulnerability in Computer Laboratory Management System using PHP and MySQL 1.0. The vulnerability occurs in the `/php-lms/classes/Users.php?f=save` endpoint via the `firstname`, `middlename`, and `lastname` parameters, allowing arbitrary script injection.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Computer Laboratory Management System using PHP and MySQL 1.0
No auth needed
Prerequisites: Access to the vulnerable endpoint
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory
https://github.com/dovankha/CVE-2024-34224

Scores

CVSS v3 7.3
EPSS 0.0087
EPSS Percentile 54.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
oretnom23/computer_laboratory_management_system 1.0
Published May 14, 2024
Tracked Since Feb 18, 2026