CVE-2024-48415 PoC — itsourcecode Loan Management System 安全漏洞

Source

https://github.com/khaliquesX/CVE-2024-48415

Associated Vulnerability

Title:itsourcecode Loan Management System 安全漏洞 (CVE-2024-48415)
Description:itsourcecode Loan Management System是itsourcecode公司的一个贷款管理系统。 itsourcecode Loan Management System v1.0版本存在安全漏洞，该漏洞源于在Borrowers页面的新借款人功能中，通过各种参数传递精心构造的载荷可以导致跨站脚本攻击。

Readme

# CVE-2024-48415

**Description**
itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlename, address, contact_no, email and tax_id parameters in new borrowers functionality on the Borrowers page.

Vulnerability Type:
Cross Site Scripting (XSS)

Vendor of Product:
itsourcecode

Affected Product Code Base:
https://itsourcecode.com/free-projects/php-project/loan-management-system-project-in-php-with-source-code/ - 1.0

Affected Component:
Loan Management System v1.0
 
Attack Vectors:
 1. Open the Loan Management System application locally.
 2. Log in to the application.
 3. Navigate to the "Borrower" section and click on the "New Borrower" functionality.
 4. Input the XSS payload <script>alert(1)</script> into the following

Reference:
https://owasp.org/www-community/attacks/xss/

File Snapshot


 [4.0K]  /data/pocs/a98a85531bf42f7a4e8a3ac24b3e73b663ed2b85
└── [ 876]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!