Vulnerability Details : CVE-2020-24609
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2020-24609
- cpe:2.3:a:techkshetrainfo:savsoft_quiz:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-24609
16.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-24609
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2020-24609
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-24609
-
https://www.exploit-db.com/exploits/48785
Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting - PHP webapps ExploitThird Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/48753
Savsoft Quiz 5 - Stored Cross-Site Scripting - PHP webapps ExploitThird Party Advisory;VDB Entry
Jump to