CVE-2024-37859
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the 'page' parameter in php-lfis/admin/index.php.
Risk Assessment
An attacker can exploit this flaw to inject malicious scripts in the context of an admin session, potentially leading to data theft, account takeover, or further privilege escalation within the system.
Recommendation
Immediately update Lost and Found Information System to the latest patched version and implement input validation and sanitization for the 'page' parameter.
Other vulnerabilities in Lost and Found Information System
See all- CVE-2024-37858Critical
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter in manage_category.php.
- CVE-2024-37857High
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter in view_category.php.
- CVE-2024-37856Medium
A Cross Site Scripting (XSS) vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, last, and middle name fields on the User Profile page.
- CVE-2023-33677High
An unauthenticated SQL injection vulnerability was discovered in Sourcecodester Lost and Found Information System version 1.0. An attacker can exploit the "id" parameter in a GET request to "?page=items/view&id=*" without authentication.
- CVE-2023-36159Medium
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to execute arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.
Original NVD description (English source)
Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS