CVE-2020-25761 — MEDIUM (6.1)

Vulnerability Description

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Projectworlds	Visitor Management System	1.0

Related Weaknesses (CWE)

CWE-79

References

http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Sep/45ExploitMailing ListThird Party Advisory
https://packetstormsecurity.com/files/author/15149/ExploitThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/48830
http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Sep/45ExploitMailing ListThird Party Advisory
https://packetstormsecurity.com/files/author/15149/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2020-25761?

CVE-2020-25761 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parame...

How severe is CVE-2020-25761?

CVE-2020-25761 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-25761?

Check the references section above for vendor advisories and patch information. Affected products include: Projectworlds Visitor Management System.