School Fees Management System v1.0 - Cross-Site Scripting (XSS) Vulnerability in "tname" parameter on "new_term"# CVE-2023-49987
# School Fees Management System v1.0 - Cross-Site Scripting (XSS) Vulnerability in "tname" parameter on "new_term"
**Description**: A cross-site scripting (XSS) vulnerability in the component “new_term” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the “tname” parameter.
**Vulnerable Product Version**: School Fees Management System v1.0
**CVE Author**: Geraldo Alcântara
**Date**: 28/11/2023
**Confirmed on**: 19/12/2023
**CVE**: CVE-2023-49987
**Tested on**: Windows
### Steps to reproduce:
To exploit the vulnerability, a user with appropriate permissions must access the "/ci_fms/admin/management/term" page. On this page, the user should either edit an existing term or add a new one. The malicious payload needs to be inserted into the "tname" parameter during this process.
**Payload:**:
```
<script>alert(document.domain)</script>
```
Discoverer(s)/Credits:
Geraldo Alcântara
登录后查看神龙缓存的 POC 文件快照
登录查看