SourceCodester School Visitor Log e-Book log-book.php cross site scripting

Successful exploitation of CVE-2023-7059 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, defacement of the application's interface, and theft of sensitive information such as login credentials or personal data. The attacker could potentially redirect users to phishing sites or install malware. Given the nature of visitor log systems, this could expose information about visitors to the school, potentially impacting privacy and security.

Schools and educational institutions utilizing the School Visitor Log e-Book software, particularly those running versions 1.0 through 1.0, are at risk. Shared hosting environments where multiple users share the same server resources could amplify the impact if one user's account is compromised.

• php / web:

 grep -r "log-book.php" /var/www/html/*

• php / web:

 curl -I http://your-school-visitor-log-url/log-book.php?Full Name=<script>alert('XSS')</script>

1. 2023-12-22Disclosure

   disclosure

1. Reserviert2023-12-21
2. Veröffentlicht2023-12-22
3. Geändert2024-11-21
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2023-7059 is to upgrade to version 1.0.1 of the School Visitor Log e-Book. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'Full Name' field to prevent the injection of malicious scripts. While a WAF might offer some protection, it's not a substitute for patching the vulnerable software. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into the 'Full Name' field and confirming that it is properly sanitized or rejected.