ZeroWdd studentmanager PermissionController. java submitAddPermission cross site scripting

The XSS vulnerability in ZeroWdd studentmanager arises from improper handling of user-supplied input within the submitAddPermission function. An attacker can craft a malicious URL containing JavaScript code, which, when processed by the application, will be executed in the context of the user's browser. This can lead to the theft of session cookies, allowing the attacker to impersonate the user. Furthermore, the attacker could inject arbitrary HTML and JavaScript, potentially defacing the application or redirecting users to malicious websites. The impact is amplified if the application is used to manage sensitive student data, as an attacker could potentially access or modify this information.

Educational institutions and organizations utilizing ZeroWdd studentmanager for student data management are at risk. Specifically, deployments with older, unpatched versions (1.0–1.0) are vulnerable. Shared hosting environments where multiple applications share the same server resources could also be affected, as a compromise of one application could potentially lead to the exploitation of this vulnerability in others.

• java / server:

find /path/to/studentmanager/src/main/java/com/zero/system/controller/ -name "PermissionController.java"

• generic web:

curl -s -X POST 'http://your-studentmanager-url/submitAddPermission?url=<script>alert(1)</script>' | grep -i alert

1. 2025-01-05Disclosure

   disclosure

1. Reserviert2025-01-05
2. Veröffentlicht2025-01-05
3. Geändert2025-01-06
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-13143 is to upgrade to version 1.0.1 of ZeroWdd studentmanager, which contains the necessary fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the url parameter in the PermissionController.java file. This can help prevent the injection of malicious scripts. Additionally, implement a Web Application Firewall (WAF) with rules to detect and block XSS attempts targeting the submitAddPermission endpoint. After upgrading, confirm the fix by attempting to submit a request with a known malicious URL payload and verifying that the script is not executed.