Platform
php
Component
rrj-nueva-ecija-engineer-online-portal
Fixed in
1.0.1
CVE-2024-0184 is a cross-site scripting (XSS) vulnerability affecting the RRJ Nueva Ecija Engineer Online Portal. This vulnerability allows attackers to inject malicious scripts into the portal, potentially compromising user accounts and data. The vulnerability impacts versions 1.0 through 1.0, and a patch is available in version 1.0.1.
An attacker could leverage this XSS vulnerability to execute arbitrary JavaScript code within the context of a user's browser session on the RRJ Nueva Ecija Engineer Online Portal. This could lead to the theft of sensitive information, such as session cookies, allowing the attacker to impersonate the user. Further exploitation could involve redirecting users to malicious websites, defacing the portal, or injecting malware. The impact is particularly concerning for administrators or users with elevated privileges within the portal, as their actions could be hijacked.
This vulnerability has been publicly disclosed, and a proof-of-concept may be available. The CVSS score is LOW (2.4), suggesting that exploitation is relatively straightforward but the potential impact is limited. As of the time of writing, there are no reports of active exploitation campaigns targeting this specific vulnerability. The vulnerability was published on 2024-01-01.
Exploit Status
EPSS
0.06% (17% percentile)
CVSS Vector
The primary mitigation for CVE-2024-0184 is to upgrade the RRJ Nueva Ecija Engineer Online Portal to version 1.0.1 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the Firstname and Lastname parameters in the /admin/edit_teacher.php file to sanitize user input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the Firstname or Lastname fields and verifying that the script is not executed.
Update the software to a patched version or apply the mitigations provided by the vendor. Sanitize user inputs Firstname/Lastname to prevent the execution of malicious JavaScript code. Consider implementing data validation and encoding on the server-side.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-0184 is a cross-site scripting (XSS) vulnerability in RRJ Nueva Ecija Engineer Online Portal versions 1.0-1.0, allowing attackers to inject malicious scripts.
You are affected if you are running RRJ Nueva Ecija Engineer Online Portal version 1.0 or 1.0. Check your version and upgrade if necessary.
Upgrade to version 1.0.1 or later. As a temporary measure, implement input validation and output encoding on the affected parameters.
There are currently no confirmed reports of active exploitation, but the vulnerability is publicly disclosed and a proof-of-concept may be available.
Refer to the vendor's official website or security advisories for the latest information regarding CVE-2024-0184.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.